Messages in this thread | | | Date | Wed, 22 May 2019 16:10:29 +0800 | From | Gen Zhang <> | Subject | Re: [PATCH v2] vt: Fix a missing-check bug in drivers/tty/vt/vt.c |
| |
On Tue, May 21, 2019 at 10:43:11PM -0400, Nicolas Pitre wrote: > On Tue, 21 May 2019, Gen Zhang wrote: > > > On Tue, May 21, 2019 at 12:30:38AM -0400, Nicolas Pitre wrote: > > > Now imagine that MIN_NR_CONSOLES is defined to 10 instead of 1. > > > > > > What happens with allocated memory if the err_vc condition is met on the > > > 5th loop? > > Yes, vc->vc_screenbuf from the last loop is still not freed, right? I > > don't have idea to solve this one. Could please give some advice? Since > > we have to consider the err_vc condition. > > > > > If err_vc_screenbuf condition is encountered on the 5th loop (curcons = > > > 4), what is the value of vc_cons[4].d? Isn't it the same as vc that you > > > just freed? > > > > > > > > > Nicolas > > Thanks for your explaination! You mean a double free situation may > > happen, right? But in vc_allocate() there is also such a kfree(vc) and > > vc_cons[currcons].d = NULL operation. This situation is really confusing > > me. > > What you could do is something that looks like: > > for (currcons = 0; currcons < MIN_NR_CONSOLES; currcons++) { > vc_cons[currcons].d = vc = kzalloc(...); > if (!vc) > goto fail1; > ... > vc->vc_screenbuf = kzalloc(...); > if (!vc->vc_screenbuf) > goto fail2; > ... > > return 0; > > /* free already allocated memory on error */ > fail1: > while (curcons > 0) { > curcons--; > kfree(vc_cons[currcons].d->vc_screenbuf); > fail2: > kfree(vc_cons[currcons].d); > vc_cons[currcons].d = NULL; > } > console_unlock(); > return -ENOMEM; > > > Nicolas Thanks for your patient explaination, Nicolas! I will work on it and resubmit it. Thanks Gen
| |