The GNU Hurd - Patches: patch #3347, Double free and memory loss...
You are not allowed to post comments on this tracker with your current authentication level.
patch #3347: Double free and memory loss probing partition table
| Submitter: | Neal H. Walfield <neal> | ||
| Submitted: | Tue 07 Sep 2004 03:10:06 PM UTC | ||
| Category: | GNU Mach | Priority: | 7 - High |
| Status: | Done | Privacy: | Public |
| Assigned to: | None | Open/Closed: | Closed |
| Planned Release: | None | ||
| Wiki-like text discussion box: |
|
||
Attached Files
Depends on the following items: None found
Items that depend on this one: None found
CC list is empty
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

While GNU Mach reads the partition table, the second assert in
linux/dev/glue:free_pages is triggered. This particular assert checks
for double frees.
I have traced the problem back to getblk and __brelse: if linux_auto_config
is true (which it is when partitions are being probed), a static buffer
is used to hold the BH structure. If getblk is called a second time
(i.e. before the first block is released), the buffer is overriden.
This results in a double free, a memory leak (as the buffer in the
first BH is never released) and a consistency problem as code which
uses the first buffer will now see different data. This is the case
in linux/dev/drivers/block/genhd.c:msdos_partition which calls bread
then, before freeing the block, calls extended_partition which also
calls bread. In reality, there is no reason to not use kalloc and
kfree here. In kern/statup.c:setup_main, we see that vm_mem_bootstrap
which calls kmem_init is called long before
linux/dev/init/main.c:linux_init is invoked by i386/i386at/machine_init:machine_init.
This attached patch changes getblk and __brelse to always use kalloc
and kfree and adds asserts to kern/kalloc.c to make sure that kalloc,
kfree and kget are only called after kmem_init has been called.
Apply the patch using -p0
ChangeLog:
2004-09-07 Neal H. Walfield <neal@cs.uml.edu>
(getblk): Unconditionally kalloc BH.
variable.
(kalloc_init): Assert that kalloc_init_called is zero.
[! NDEBUG] Set kalloc_init_called to 1 on success.
(kalloc): Assert that kalloc_init_called is non-zero.
(kget): Likewise.
(kfree): Likewise.