Re: [RFC] [PATCH] Pre-emption control for userspace

[Khalid Aziz <khalid.aziz@oracle.com>]

On Tue, 2014-03-04 at 18:38 +0000, Al Viro wrote:
> On Tue, Mar 04, 2014 at 10:44:54AM -0700, Khalid Aziz wrote:
> 
> > do_exit() unmaps mmap_state->uaddr, and frees up mmap_state->kaddr
> > and mmap_state. mmap_state should not be NULL after unmap. vfree()
> > and kfree() are tolerant of pointers that have already been freed.
> 
> Huh?  Double free() is a bug, plain and simple.  Never do that - not
> in userland and especially not in the kernel.  Think what happens if
> some code gets executed between those two and asks to allocate something.
> If it gets the area you'd just freed, your second free will leave it
> with all kinds of nasty surprises.  Starting with "who the hell has
> started to modify the object I'd allocated and hadn't freed?"
> 
> A:	p = alloc();
> A:	free(p);
> B:	q = alloc();	/* q == p now */
> B:	*q = 0;		/* *q is zero */
> A:	free(p);	/* same as free(q) */
> C:	r = alloc();	/* r == q now */
> C:	*r = 1;		/* *q is one */
> B:	if (*q != 0) panic("somebody's buggering my memory");
> 
> It's always a bug, whether the implementation catches it or not.

Agreed, you are right. I will fix it.

--
Khalid