lkml.org 
[lkml]   [2021]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] regmap: Fix possible double-free in regcache_rbtree_exit()
From
Date
Hi,

On 2021/10/12 1:40, Mark Brown wrote:
> On Mon, Oct 11, 2021 at 09:55:26PM +0800, Yang Yingliang wrote:
>> In regcache_rbtree_insert_to_block(), when 'present' realloc failed,
>> the 'blk' which is supposed to assign to 'rbnode->block' will be freed,
>> so 'rbnode->block' points a freed memory, in the error handling path of
>> regcache_rbtree_init(), 'rbnode->block' will be freed again in
>> regcache_rbtree_exit(), KASAN will report double-free as follows:
>>
>> BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390
>> Call Trace:
>> dump_stack_lvl+0xe2/0x152
>> print_address_description.constprop.7+0x21/0x150
>> kasan_report_invalid_free+0x6f/0xa0
>> __kasan_slab_free+0x125/0x140
> Please think hard before including complete backtraces in upstream
> reports, they are very large and contain almost no useful information
> relative to their size so often obscure the relevant content in your
> message. If part of the backtrace is usefully illustrative (it often is
> for search engines if nothing else) then it's usually better to pull out
> the relevant sections.
OK
>
>> Set rbnode->block to NULL when the 'present' realloc failed to fix this.
> This is not a good fix, it will both leak block and corrupt the data
> structure since now there's a NULL pointer where there should be a data
> block. We should instead be moving the assignment of rbnode->block up
> to immediately after the reallocation has succeeded so that the data
> structure stays valid even if the second reallocation fails.
I will send a v2 later.

Thanks,
Yang

\
 
 \ /
  Last update: 2021-10-12 03:18    [W:0.414 / U:0.040 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site