diff options
| author | Xi Wang <xi.wang@gmail.com> | 2012-06-01 12:22:00 -0400 |
|---|---|---|
| committer | Christopher Li <sparse@chrisli.org> | 2012-06-04 15:36:31 -0700 |
| commit | 4c982e9d3c6827afb529c7c7ce7fbe987eac24c6 (patch) | |
| tree | 8d2366a1a2d97e2db8b658d339d8661b2377785f /validation | |
| parent | 970d7169d75068146152ba01a66381c800dbeb71 (diff) | |
| download | sparse-dev-4c982e9d3c6827afb529c7c7ce7fbe987eac24c6.tar.gz | |
compile-i386: fix use-after-free in func_cleanup()
compile-i386 sometimes crashes due a use-after-free error. Since
f->pseudo_list is freed first, which invalidates some atom->op* in
f->atom_list. Further checks like `atom->op1->flags & STOR_WANTS_FREE'
will read garbage, which may lead to a double free.
This patch switches the cleanup order and frees f->atom_list first.
Those marked as STOR_WANTS_FREE won't appear in f->pseudo_list.
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Christopher Li <sparse@chrisli.org>
Reviewed-by: Pekka Enberg <penberg@kernel.org>
Diffstat (limited to 'validation')
0 files changed, 0 insertions, 0 deletions