Re: [PATCH] ceph: fix potential double free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 07/13/2012 09:28 AM, Alan Cox wrote:
> From: Alan Cox <alan@xxxxxxxxxxxxxxx>
> 
> We re-run the loop but we don't re-set the attrs pointer back to NULL.

It looks to me like we're OK here without this.

At the top of the loop, the if condition either holds or it does not.
- If it does not, we don't touch "xattrs" again, before returning "err".
- If the condition holds, the next time "xattrs" is touched is when its
  value is assigned the result of a kcalloc() call.

That being said, I really do prefer to have pointers get invalidated
after their freed, so I'll happily add your change...

Reviewed-by: Alex Elder <elder@xxxxxxxxxxx>

> Signed-off-by: Alan Cox <alan@xxxxxxxxxxxxxxx>
> ---
> 
>  fs/ceph/xattr.c |    1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
> index 785cb30..2c2ae5b 100644
> --- a/fs/ceph/xattr.c
> +++ b/fs/ceph/xattr.c
> @@ -457,6 +457,7 @@ start:
>  			for (i = 0; i < numattr; i++)
>  				kfree(xattrs[i]);
>  			kfree(xattrs);
> +			xattrs = NULL;
>  			goto start;
>  		}
>  		err = -EIO;
> 
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 
> 


--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [CEPH Users]     [Ceph Large]     [Information on CEPH]     [Linux BTRFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]
  Powered by Linux