Discovered on x86-64 and now ported.
copy_thread could leak memory if you had a io bitmap and passed wrong
arguments to the new clone flags.
-Andi
--- linux/arch/i386/kernel/process.c 2003-02-26 12:55:16.000000000 +0100
+++ linux-2.5.63-work/arch/i386/kernel/process.c 2003-03-04 22:28:20.000000000 +0100
@@ -281,6 +281,7 @@
{
struct pt_regs * childregs;
struct task_struct *tsk;
+ int err;
childregs = ((struct pt_regs *) (THREAD_SIZE + (unsigned long) p->thread_info)) - 1;
struct_cpy(childregs, regs);
@@ -316,20 +317,27 @@
struct user_desc info;
int idx;
+ err = -EFAULT;
if (copy_from_user(&info, (void *)childregs->esi, sizeof(info)))
- return -EFAULT;
+ goto out;
+ err = -EINVAL;
if (LDT_empty(&info))
- return -EINVAL;
+ goto out;
idx = info.entry_number;
if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
- return -EINVAL;
+ goto out;
desc = p->thread.tls_array + idx - GDT_ENTRY_TLS_MIN;
desc->a = LDT_entry_a(&info);
desc->b = LDT_entry_b(&info);
}
- return 0;
+
+ err = 0;
+ out:
+ if (p->thread.ts_io_bitmap)
+ kfree(p->thread.ts_io_bitmap);
+ return err;
}
/*
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sat Mar 15 2003 - 22:00:18 EST