Messages in this thread | | | Subject | Re: [PATCH] regmap: Fix possible double-free in regcache_rbtree_exit() | From | Yang Yingliang <> | Date | Tue, 12 Oct 2021 09:18:13 +0800 |
| |
Hi,
On 2021/10/12 1:40, Mark Brown wrote: > On Mon, Oct 11, 2021 at 09:55:26PM +0800, Yang Yingliang wrote: >> In regcache_rbtree_insert_to_block(), when 'present' realloc failed, >> the 'blk' which is supposed to assign to 'rbnode->block' will be freed, >> so 'rbnode->block' points a freed memory, in the error handling path of >> regcache_rbtree_init(), 'rbnode->block' will be freed again in >> regcache_rbtree_exit(), KASAN will report double-free as follows: >> >> BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 >> Call Trace: >> dump_stack_lvl+0xe2/0x152 >> print_address_description.constprop.7+0x21/0x150 >> kasan_report_invalid_free+0x6f/0xa0 >> __kasan_slab_free+0x125/0x140 > Please think hard before including complete backtraces in upstream > reports, they are very large and contain almost no useful information > relative to their size so often obscure the relevant content in your > message. If part of the backtrace is usefully illustrative (it often is > for search engines if nothing else) then it's usually better to pull out > the relevant sections. OK > >> Set rbnode->block to NULL when the 'present' realloc failed to fix this. > This is not a good fix, it will both leak block and corrupt the data > structure since now there's a NULL pointer where there should be a data > block. We should instead be moving the assignment of rbnode->block up > to immediately after the reallocation has succeeded so that the data > structure stays valid even if the second reallocation fails. I will send a v2 later.
Thanks, Yang
| |