Skip to content

Commit 554f07a

Browse files
paulmckrcuNeeraj Upadhyay
authored andcommitted
rcuscale: NULL out top-level pointers to heap memory
Currently, if someone modprobes and rmmods rcuscale successfully, but the next run errors out during the modprobe, non-NULL pointers to freed memory will remain. If the run after that also errors out during the modprobe, there will be double-free bugs. This commit therefore NULLs out top-level pointers to memory that has just been freed. Signed-off-by: "Paul E. McKenney" <[email protected]> Signed-off-by: Neeraj Upadhyay <[email protected]>
1 parent 1c3e6e7 commit 554f07a

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

kernel/rcu/rcuscale.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -819,6 +819,7 @@ kfree_scale_cleanup(void)
819819
torture_stop_kthread(kfree_scale_thread,
820820
kfree_reader_tasks[i]);
821821
kfree(kfree_reader_tasks);
822+
kfree_reader_tasks = NULL;
822823
}
823824

824825
torture_cleanup_end();
@@ -987,6 +988,7 @@ rcu_scale_cleanup(void)
987988
torture_stop_kthread(rcu_scale_reader,
988989
reader_tasks[i]);
989990
kfree(reader_tasks);
991+
reader_tasks = NULL;
990992
}
991993

992994
if (writer_tasks) {
@@ -1043,8 +1045,11 @@ rcu_scale_cleanup(void)
10431045
}
10441046
}
10451047
kfree(writer_tasks);
1048+
writer_tasks = NULL;
10461049
kfree(writer_durations);
1050+
writer_durations = NULL;
10471051
kfree(writer_n_durations);
1052+
writer_n_durations = NULL;
10481053
kfree(writer_done);
10491054
writer_done = NULL;
10501055
kfree(writer_freelists);

0 commit comments

Comments
 (0)