lkml.org 
[lkml]   [2010]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] CRED: Fix double free in prepare_usermodehelper_creds() error handling
    * David Howells (dhowells@redhat.com) wrote:
    > Patch 570b8fb505896e007fd3bb07573ba6640e51851d:
    >
    > Author: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    > Date: Tue Mar 30 00:04:00 2010 +0100
    > Subject: CRED: Fix memory leak in error handling
    >
    > attempts to fix a memory leak in the error handling by making the offending
    > return statement into a jump down to the bottom of the function where a
    > kfree(tgcred) is inserted.
    >
    > This is, however, incorrect, as it does a kfree() after doing put_cred() if
    > security_prepare_creds() fails. That will result in a double free if 'error'
    > is jumped to as put_cred() will also attempt to free the new tgcred record by
    > virtue of it being pointed to by the new cred record.

    OK, I missed the fact taht put_cred() performs the kfree. Thanks for the fix.

    Acked-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>

    >
    > Signed-off-by: David Howells <dhowells@redhat.com>
    > ---
    >
    > kernel/cred.c | 2 ++
    > 1 files changed, 2 insertions(+), 0 deletions(-)
    >
    > diff --git a/kernel/cred.c b/kernel/cred.c
    > index e1dbe9e..ce1a52b 100644
    > --- a/kernel/cred.c
    > +++ b/kernel/cred.c
    > @@ -398,6 +398,8 @@ struct cred *prepare_usermodehelper_creds(void)
    >
    > error:
    > put_cred(new);
    > + return NULL;
    > +
    > free_tgcred:
    > #ifdef CONFIG_KEYS
    > kfree(tgcred);
    >

    --
    Mathieu Desnoyers
    Operating System Efficiency R&D Consultant
    EfficiOS Inc.
    http://www.efficios.com


    \
     
     \ /
      Last update: 2010-04-21 15:49    [W:0.023 / U:0.332 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site