From: Chris Wright Date: Fri, 1 Jun 2007 07:46:39 +0000 (-0700) Subject: x86: fix oprofile double free X-Git-Tag: v2.6.22-rc4~48 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0939c17c7bcf1c838bea4445b80a6966809a438f;p=linux-2.6 x86: fix oprofile double free Chuck reports that the recent fix from Andi to oprofile 6c977aad03a18019015035958c65b6729cd0574c introduces a double free. Each cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free cpu 0's pointers for_each_possible_cpu. Rather than copy the pointers, do a deep copy instead. [acme@redhat.com: allocate_msrs() was using for_each_online_cpu()] Signed-off-by: Chris Wright Cc: Andi Kleen Cc: Alan Cox Cc: Dave Jones Cc: Chuck Ebbert Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/arch/i386/oprofile/nmi_int.c b/arch/i386/oprofile/nmi_int.c index a7c0783b26..11b7a51566 100644 --- a/arch/i386/oprofile/nmi_int.c +++ b/arch/i386/oprofile/nmi_int.c @@ -154,7 +154,7 @@ static int allocate_msrs(void) size_t counters_size = sizeof(struct op_msr) * model->num_counters; int i; - for_each_online_cpu(i) { + for_each_possible_cpu(i) { cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL); if (!cpu_msrs[i].counters) { success = 0; @@ -211,8 +211,14 @@ static int nmi_setup(void) /* Assume saved/restored counters are the same on all CPUs */ model->fill_in_addresses(&cpu_msrs[0]); for_each_possible_cpu (cpu) { - if (cpu != 0) - cpu_msrs[cpu] = cpu_msrs[0]; + if (cpu != 0) { + memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters, + sizeof(struct op_msr) * model->num_counters); + + memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls, + sizeof(struct op_msr) * model->num_controls); + } + } on_each_cpu(nmi_save_registers, NULL, 0, 1); on_each_cpu(nmi_cpu_setup, NULL, 0, 1);