bugGNU GRUB - Bugs: bug #42765, TCP stack frees wrong netbuff,...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #42765: TCP stack frees wrong netbuff, twice (double free)

Submitter:  Curtis Larsen <fractal13>
Submitted:  Sun 13 Jul 2014 05:05:28 PM UTC
   
 
Category:  Network Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  Fixed Privacy:  Public
Assigned to:  None Originator Name:  Curtis Larsen
Open/Closed:  Closed Release:  Git master
Release:  Reproducibility:  Every Time
Planned Release:  None

Sun 07 Dec 2014 08:32:14 AM UTC, comment #2: 

Fixed in 06eadf5ebf21c8520d696c6438a976e5f7c218c3.

I'm still not sure what conditions cause this bug to happen. tcpdump of affected session would be interesting.

Thank you!

Andrei Borzenkov <arvidjaar>
Group Member
Sat 06 Dec 2014 08:06:09 PM UTC, comment #1: 

I still cannot reproduce it. Could you give more detailed instructions or information about your setup?

Andrei Borzenkov <arvidjaar>
Group Member
Sun 13 Jul 2014 05:05:28 PM UTC, original submission:  

Using the http module to download config files, produces memory errors, after the config file is downloaded.

The error was traced to the tcp stack in grub-core/net/tcp.c.  The wrong netbuff pointer was being freed in the clean up loop.

Changing the code to free the correct netbuff pointer removes the runtime error.

Here's the git diff output:

diff --git a/grub-core/net/tcp.c b/grub-core/net/tcp.c
index 2077f55..1d90f1e 100644
--- a/grub-core/net/tcp.c
+++ b/grub-core/net/tcp.c
@@ -918,7 +918,7 @@ grub_net_recv_tcp_packet (struct grub_net_buff *nb,
              do_ack = 1;
            }
          else
-           grub_netbuff_free (nb);
+           grub_netbuff_free (nb_top);
        }
       if (do_ack)
        ack (sock);

Thanks for the code!



Curtis Larsen <fractal13>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by arvidjaar (Posted a comment)
  • -email is unavailable- added by fractal13 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-12-07 arvidjaar StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code