diff options
| -rw-r--r-- | debian/changelog | 2 | ||||
| -rw-r--r-- | debian/patches/17_fix_double_free.patch | 122 |
2 files changed, 124 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog index 2aef3eb..850a493 100644 --- a/debian/changelog +++ b/debian/changelog @@ -9,6 +9,8 @@ gnumach (1:20040915.dfsg.1-1) unstable; urgency=low * Disable qlogicisp firmware loading. * Enable debug code by default (disable with NDEBUG). Thanks to Neal H. Walfield <neal@cs.uml.edu>. + * Fix double free and memory loss probing partition table. + Thanks to Neal H. Walfield <neal@cs.uml.edu>. -- Guillem Jover <guillem@debian.org> Tue, 16 Nov 2004 07:58:02 +0100 diff --git a/debian/patches/17_fix_double_free.patch b/debian/patches/17_fix_double_free.patch new file mode 100644 index 0000000..8969b91 --- /dev/null +++ b/debian/patches/17_fix_double_free.patch @@ -0,0 +1,122 @@ +#DPATCHLEVEL=0 + +2004-09-07 Neal H. Walfield <neal@cs.uml.edu> + + * linux/dev/glue/block.c (__brelse): Unconditionally kfree BH. + (getblk): Unconditionally kalloc BH. + + * kern/kalloc.c [!NDEBUG] (kalloc_init_called): New static + variable. + (kalloc_init): Assert that kalloc_init_called is zero. + [! NDEBUG] Set kalloc_init_called to 1 on success. + (kalloc): Assert that kalloc_init_called is non-zero. + (kget): Likewise. + (kfree): Likewise. + + +Index: linux/dev/glue/block.c +=================================================================== +RCS file: /cvsroot/hurd/gnumach/linux/dev/glue/Attic/block.c,v +retrieving revision 1.8.2.2 +diff -u -p -r1.8.2.2 block.c +--- linux/dev/glue/block.c 19 Jan 2004 01:44:31 -0000 1.8.2.2 ++++ linux/dev/glue/block.c 7 Sep 2004 15:08:17 -0000 +@@ -354,22 +354,17 @@ struct buffer_head * + getblk (kdev_t dev, int block, int size) + { + struct buffer_head *bh; +- static struct buffer_head bhead; + + assert (size <= PAGE_SIZE); + +- if (! linux_auto_config) +- bh = (struct buffer_head *) kalloc (sizeof (struct buffer_head)); +- else +- bh = &bhead; ++ bh = (struct buffer_head *) kalloc (sizeof (struct buffer_head)); + if (bh) + { + memset (bh, 0, sizeof (struct buffer_head)); + bh->b_data = alloc_buffer (size); + if (! bh->b_data) + { +- if (! linux_auto_config) +- kfree ((vm_offset_t) bh, sizeof (struct buffer_head)); ++ kfree ((vm_offset_t) bh, sizeof (struct buffer_head)); + return NULL; + } + bh->b_dev = dev; +@@ -385,8 +380,7 @@ void + __brelse (struct buffer_head *bh) + { + free_buffer (bh->b_data, bh->b_size); +- if (! linux_auto_config) +- kfree ((vm_offset_t) bh, sizeof (*bh)); ++ kfree ((vm_offset_t) bh, sizeof (*bh)); + } + + /* Allocate a buffer of SIZE bytes and fill it with data +Index: kern/kalloc.c +=================================================================== +RCS file: /cvsroot/hurd/gnumach/kern/kalloc.c,v +retrieving revision 1.1.1.1 +diff -u -p -r1.1.1.1 kalloc.c +--- kern/kalloc.c 25 Feb 1997 21:28:23 -0000 1.1.1.1 ++++ kern/kalloc.c 7 Sep 2004 15:08:17 -0000 +@@ -106,12 +106,18 @@ unsigned long k_zone_max[16] = { + * This initializes all of the zones. + */ + ++#ifndef NDEBUG ++static int kalloc_init_called; ++#endif ++ + void kalloc_init() + { + vm_offset_t min, max; + vm_size_t size; + register int i; + ++ assert (! kalloc_init_called); ++ + kalloc_map = kmem_suballoc(kernel_map, &min, &max, + kalloc_map_size, FALSE); + +@@ -142,6 +148,10 @@ void kalloc_init() + size >= PAGE_SIZE ? ZONE_COLLECTABLE : 0, + k_zone_name[i]); + } ++ ++#ifndef NDEBUG ++ kalloc_init_called = 1; ++#endif + } + + vm_offset_t kalloc(size) +@@ -153,6 +163,8 @@ vm_offset_t kalloc(size) + + /* compute the size of the block that we will actually allocate */ + ++ assert (kalloc_init_called); ++ + allocsize = size; + if (size < kalloc_max) { + allocsize = MINSIZE; +@@ -185,6 +197,8 @@ vm_offset_t kget(size) + register vm_size_t allocsize; + vm_offset_t addr; + ++ assert (kalloc_init_called); ++ + /* compute the size of the block that we will actually allocate */ + + allocsize = size; +@@ -219,6 +233,8 @@ kfree(data, size) + register int zindex; + register vm_size_t freesize; + ++ assert (kalloc_init_called); ++ + freesize = size; + if (size < kalloc_max) { + freesize = MINSIZE; |