Commit 42862298 authored by Kirill Korotaev's avatar Kirill Korotaev Committed by Linus Torvalds

[PATCH] wrong error path in dup_fd() leading to oopses in RCU

Wrong error path in dup_fd() - it should return NULL on error,
not an address of already freed memory :/

Triggered by OpenVZ stress test suite.

What is interesting is that it was causing different oopses in RCU like
below:
Call Trace:
   [<c013492c>] rcu_do_batch+0x2c/0x80
   [<c0134bdd>] rcu_process_callbacks+0x3d/0x70
   [<c0126cf3>] tasklet_action+0x73/0xe0
   [<c01269aa>] __do_softirq+0x10a/0x130
   [<c01058ff>] do_softirq+0x4f/0x60
   =======================
   [<c0113817>] smp_apic_timer_interrupt+0x77/0x110
   [<c0103b54>] apic_timer_interrupt+0x1c/0x24
  Code:  Bad EIP value.
   <0>Kernel panic - not syncing: Fatal exception in interrupt
Signed-Off-By: default avatarPavel Emelianov <xemul@sw.ru>
Signed-Off-By: default avatarDmitry Mishin <dim@openvz.org>
Signed-Off-By: default avatarKirill Korotaev <dev@openvz.org>
Signed-Off-By: default avatarLinus Torvalds <torvalds@osdl.org>
parent e358c1a2
...@@ -725,7 +725,7 @@ static struct files_struct *dup_fd(struct files_struct *oldf, int *errorp) ...@@ -725,7 +725,7 @@ static struct files_struct *dup_fd(struct files_struct *oldf, int *errorp)
free_fdset (new_fdt->open_fds, new_fdt->max_fdset); free_fdset (new_fdt->open_fds, new_fdt->max_fdset);
free_fd_array(new_fdt->fd, new_fdt->max_fds); free_fd_array(new_fdt->fd, new_fdt->max_fds);
kmem_cache_free(files_cachep, newf); kmem_cache_free(files_cachep, newf);
goto out; return NULL;
} }
static int copy_files(unsigned long clone_flags, struct task_struct * tsk) static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment