diff options
| author | Kirill Korotaev <dev@openvz.org> | 2006-04-01 16:06:50 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2006-04-07 09:44:28 -0700 |
| commit | 4575a939b95321a62ddf8ecfefd3c7852091bcc5 (patch) | |
| tree | 57cd51b3fe0db6565dc1f49df169fe4c0aa6a03d | |
| parent | 334ed376d2b23896061520648dc7113c5c4ffb0b (diff) | |
| download | lwn-4575a939b95321a62ddf8ecfefd3c7852091bcc5.tar.gz lwn-4575a939b95321a62ddf8ecfefd3c7852091bcc5.zip | |
[PATCH] wrong error path in dup_fd() leading to oopses in RCU
Wrong error path in dup_fd() - it should return NULL on error,
not an address of already freed memory :/
Triggered by OpenVZ stress test suite.
What is interesting is that it was causing different oopses in RCU like
below:
Call Trace:
[<c013492c>] rcu_do_batch+0x2c/0x80
[<c0134bdd>] rcu_process_callbacks+0x3d/0x70
[<c0126cf3>] tasklet_action+0x73/0xe0
[<c01269aa>] __do_softirq+0x10a/0x130
[<c01058ff>] do_softirq+0x4f/0x60
=======================
[<c0113817>] smp_apic_timer_interrupt+0x77/0x110
[<c0103b54>] apic_timer_interrupt+0x1c/0x24
Code: Bad EIP value.
<0>Kernel panic - not syncing: Fatal exception in interrupt
Signed-Off-By: Pavel Emelianov <xemul@sw.ru>
Signed-Off-By: Dmitry Mishin <dim@openvz.org>
Signed-Off-By: Kirill Korotaev <dev@openvz.org>
Signed-Off-By: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | kernel/fork.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/fork.c b/kernel/fork.c index b373322ca497..9d4e0d8b65e6 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -720,7 +720,7 @@ out_release: free_fdset (new_fdt->open_fds, new_fdt->max_fdset); free_fd_array(new_fdt->fd, new_fdt->max_fds); kmem_cache_free(files_cachep, newf); - goto out; + return NULL; } static int copy_files(unsigned long clone_flags, struct task_struct * tsk) |