mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 10:40:15 +02:00 
			
		
		
		
	[PATCH] uml: make daemon transport behave properly
Avoid uninitialized data in the daemon_data structure. I used this transport before doing proper setup before-hand, and I got some very nice SLAB corruption due to freeing crap pointers. So just make sure to clear everything when appropriate. Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it> Cc: Jeff Dike <jdike@addtoit.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
		
							parent
							
								
									3b948068b8
								
							
						
					
					
						commit
						c42791b6ec
					
				
					 2 changed files with 10 additions and 0 deletions
				
			
		| 
						 | 
					@ -31,6 +31,10 @@ void daemon_init(struct net_device *dev, void *data)
 | 
				
			||||||
	dpri->fd = -1;
 | 
						dpri->fd = -1;
 | 
				
			||||||
	dpri->control = -1;
 | 
						dpri->control = -1;
 | 
				
			||||||
	dpri->dev = dev;
 | 
						dpri->dev = dev;
 | 
				
			||||||
 | 
						/* We will free this pointer. If it contains crap we're burned. */
 | 
				
			||||||
 | 
						dpri->ctl_addr = NULL;
 | 
				
			||||||
 | 
						dpri->data_addr = NULL;
 | 
				
			||||||
 | 
						dpri->local_addr = NULL;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	printk("daemon backend (uml_switch version %d) - %s:%s", 
 | 
						printk("daemon backend (uml_switch version %d) - %s:%s", 
 | 
				
			||||||
	       SWITCH_VERSION, dpri->sock_type, dpri->ctl_sock);
 | 
						       SWITCH_VERSION, dpri->sock_type, dpri->ctl_sock);
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
| 
						 | 
					@ -158,10 +158,16 @@ static void daemon_remove(void *data)
 | 
				
			||||||
	struct daemon_data *pri = data;
 | 
						struct daemon_data *pri = data;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	os_close_file(pri->fd);
 | 
						os_close_file(pri->fd);
 | 
				
			||||||
 | 
						pri->fd = -1;
 | 
				
			||||||
	os_close_file(pri->control);
 | 
						os_close_file(pri->control);
 | 
				
			||||||
 | 
						pri->control = -1;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	kfree(pri->data_addr);
 | 
						kfree(pri->data_addr);
 | 
				
			||||||
 | 
						pri->data_addr = NULL;
 | 
				
			||||||
	kfree(pri->ctl_addr);
 | 
						kfree(pri->ctl_addr);
 | 
				
			||||||
 | 
						pri->ctl_addr = NULL;
 | 
				
			||||||
	kfree(pri->local_addr);
 | 
						kfree(pri->local_addr);
 | 
				
			||||||
 | 
						pri->local_addr = NULL;
 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
int daemon_user_write(int fd, void *buf, int len, struct daemon_data *pri)
 | 
					int daemon_user_write(int fd, void *buf, int len, struct daemon_data *pri)
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
		Reference in a new issue