Messages in this thread | | | Date | Thu, 17 Sep 2015 13:38:55 -0400 | Subject | Re: [PATCH v5 2/3] tty: fix data race in tty_buffer_flush | From | Peter Hurley <> |
| |
On Thu, Sep 17, 2015 at 11:17 AM, Dmitry Vyukov <dvyukov@google.com> wrote: > tty_buffer_flush frees not acquired buffers. > As the result, for example, read of b->size in tty_buffer_free > can return garbage value which will lead to a huge buffer > hanging in the freelist. This is just the benignest > manifestation of freeing of a not acquired object. > If the object is passed to kfree, heap can be corrupted. > > Acquire visibility over the buffer before freeing it. > > The data race was found with KernelThreadSanitizer (KTSAN).
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
| |