lkml.org 
[lkml]   [2003]   [Mar]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [PATCH] Fix memory leak in copy_thread - correction.
From
Date
Andi Kleen <ak@muc.de> writes:

> Discovered on x86-64 and now ported.
>
> copy_thread could leak memory if you had a io bitmap and passed wrong
> arguments to the new clone flags.

[...]

Oops that was the wrong buggy version of the patch. Please ignore that
and use this one

-Andi

--- linux/arch/i386/kernel/process.c 2003-02-26 12:55:16.000000000 +0100
+++ linux-2.5.63-work/arch/i386/kernel/process.c 2003-03-04 22:28:20.000000000 +0100
@@ -281,6 +281,7 @@
{
struct pt_regs * childregs;
struct task_struct *tsk;
+ int err;

childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1;
struct_cpy(childregs, regs);
@@ -316,20 +317,27 @@
struct user_desc info;
int idx;

+ err = -EFAULT;
if (copy_from_user(&info, (void *)childregs->esi, sizeof(info)))
- return -EFAULT;
+ goto out;
+ err = -EINVAL;
if (LDT_empty(&info))
- return -EINVAL;
+ goto out;

idx = info.entry_number;
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
- return -EINVAL;
+ goto out;

desc = p->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
desc->a = LDT_entry_a(&info);
desc->b = LDT_entry_b(&info);
}
- return 0;
+
+ err = 0;
+ out:
+ if (!err && p->thread.ts_io_bitmap)
+ kfree(p->thread.ts_io_bitmap);
+ return err;
}

/*
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-03-22 13:33    [W:0.321 / U:0.372 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site