kernel_samsung_sm7125

jenna

History

Jesper Juhl bdc3e603cd fix use after free in amd create gatt pages Coverity spotted a "use after free" bug in drivers/char/agp/amd-k7-agp.c::amd_create_gatt_pages(). The problem is this: If "entry = kzalloc(sizeof(struct amd_page_map), GFP_KERNEL);" fails, then there's a loop in the function to free all entries allocated so far and break out of the allocation loop. That in itself is pretty sane, but then the (now freed) 'tables' is assigned to amd_irongate_private.gatt_pages and 'retval' is set to -ENOMEM which causes amd_free_gatt_pages(); to be called at the end of the function. The problem with this is that amd_free_gatt_pages() will then loop 'amd_irongate_private.num_tables' times and try to free each entry in tables[] - this is bad since tables has already been freed and furthermore it will call kfree(tables) at the end - a double free. This patch removes the freeing loop in amd_create_gatt_pages() and instead relies entirely on the call to amd_free_gatt_pages() to free everything we allocated in case of an error. It also sets amd_irongate_private.num_tables to the actual number of entries allocated instead of just using the value passed in from the caller - this ensures that amd_free_gatt_pages() will only attempt to free stuff that was actually allocated. Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Dave Airlie <airlied@redhat.com>		18 years ago
..
Kconfig	…
Makefile	…
agp.h	AGP fix race condition between unmapping and freeing pages	18 years ago
ali-agp.c	AGP fix race condition between unmapping and freeing pages	18 years ago
alpha-agp.c	…
amd-k7-agp.c	fix use after free in amd create gatt pages	18 years ago
amd64-agp.c	…
ati-agp.c	agp: balance ioremap checks	18 years ago
backend.c	AGP fix race condition between unmapping and freeing pages	18 years ago
compat_ioctl.c	…
compat_ioctl.h	…
efficeon-agp.c	efficeon-agp leaks 'struct agp_bridge_data' in error paths of agp_efficeon_probe()	18 years ago
frontend.c	…
generic.c	AGP fix race condition between unmapping and freeing pages	18 years ago
hp-agp.c	agp: balance ioremap checks	18 years ago
i460-agp.c	AGP fix race condition between unmapping and freeing pages	18 years ago
intel-agp.c	AGP fix race condition between unmapping and freeing pages	18 years ago
isoch.c	…
nvidia-agp.c	agp: balance ioremap checks	18 years ago
parisc-agp.c	…
sgi-agp.c	…
sis-agp.c	…
sworks-agp.c	…
uninorth-agp.c	…
via-agp.c	agp: Add device id for P4M900 to via-agp module	18 years ago