Messages in this thread Patch in this message | | | Subject | Re: [PATCH] Fix memory leak in copy_thread - correction. | From | Andi Kleen <> | Date | Sun, 09 Mar 2003 18:20:36 +0100 |
| |
Andi Kleen <ak@muc.de> writes:
> Discovered on x86-64 and now ported. > > copy_thread could leak memory if you had a io bitmap and passed wrong > arguments to the new clone flags.
[...]
Oops that was the wrong buggy version of the patch. Please ignore that and use this one
-Andi
--- linux/arch/i386/kernel/process.c 2003-02-26 12:55:16.000000000 +0100 +++ linux-2.5.63-work/arch/i386/kernel/process.c 2003-03-04 22:28:20.000000000 +0100 @@ -281,6 +281,7 @@ { struct pt_regs * childregs; struct task_struct *tsk; + int err; childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1; struct_cpy(childregs, regs); @@ -316,20 +317,27 @@ struct user_desc info; int idx; + err = -EFAULT; if (copy_from_user(&info, (void *)childregs->esi, sizeof(info))) - return -EFAULT; + goto out; + err = -EINVAL; if (LDT_empty(&info)) - return -EINVAL; + goto out; idx = info.entry_number; if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX) - return -EINVAL; + goto out; desc = p->thread.tls_array + idx - GDT_ENTRY_TLS_MIN; desc->a = LDT_entry_a(&info); desc->b = LDT_entry_b(&info); } - return 0; + + err = 0; + out: + if (!err && p->thread.ts_io_bitmap) + kfree(p->thread.ts_io_bitmap); + return err; } /* - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |