• Vegard Nossum's avatar
    mm: fix lazy vmap purging (use-after-free error) · cbb76676
    Vegard Nossum authored
    I just got this new warning from kmemcheck:
    
        WARNING: kmemcheck: Caught 32-bit read from freed memory (c7806a60)
        a06a80c7ecde70c1a04080c700000000a06709c1000000000000000000000000
         f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f f
         ^
    
        Pid: 0, comm: swapper Not tainted (2.6.29-rc4 #230)
        EIP: 0060:[<c1096df7>] EFLAGS: 00000286 CPU: 0
        EIP is at __purge_vmap_area_lazy+0x117/0x140
        EAX: 00070f43 EBX: c7806a40 ECX: c1677080 EDX: 00027b66
        ESI: 00002001 EDI: c170df0c EBP: c170df00 ESP: c178830c
         DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
        CR0: 80050033 CR2: c7806b14 CR3: 01775000 CR4: 00000690
        DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
        DR6: 00004000 DR7: 00000000
         [<c1096f3e>] free_unmap_vmap_area_noflush+0x6e/0x70
         [<c1096f6a>] remove_vm_area+0x2a/0x70
         [<c1097025>] __vunmap+0x45/0xe0
         [<c10970de>] vunmap+0x1e/0x30
         [<c1008ba5>] text_poke+0x95/0x150
         [<c1008ca9>] a...
    cbb76676
vmalloc.c 43.5 KB