[PATCH] Bug in kernel/fork.c in 2.4.4 kernel

[PATCH] Bug in kernel/fork.c in 2.4.4 kernel

[Don Dugger]

In working on thread core dumps I've stumbled across a minor bug in the
generic `fork' code.  The problem code is in routine `copy_mm' in
`kernel/fork.c':

	/* Copy the current MM stuff.. */
        memcpy(mm, oldmm, sizeof(*mm));
	  .
	  .
	  .
        if (retval)
                goto free_pt;

        /*
         * child gets a private LDT (if there was an LDT in the parent)
         */
        copy_segments(tsk, mm);
	  .
	  .
	  .
free_pt:
	mmput(mm);

The new `mm' doesn't get it's own private version of it's `context'
field until after the call to `copy_segments'.  At the `goto' the pointer
`mm' points to a copy of the old `mm_struct', including a copy of the
`context' field.  `mmput' will call `release_segments' which will free
the memory pointed to by the `context' field.  Later, when `oldmm' is
freed, the kernel will try to free the same memory twice - very bad.

Admittedly, this will only occur on an obscure error condition but
it should be fixed.  The attached patch fixes the problem by zeroing
out the `context' field immediately after the `mm' structure is
copied.
-- 
Don Dugger
"Censeo Toto nos in Kansa esse decisse." - D. Gale
n0ano@valinux.com
Ph: 303/938-9838


--- linux-2.4.4-ref/kernel/fork.c	Thu Apr 26 07:11:17 2001
+++ linux/kernel/fork.c	Wed May  2 14:39:38 2001
@@ -311,6 +311,10 @@
 
 	/* Copy the current MM stuff.. */
 	memcpy(mm, oldmm, sizeof(*mm));
+
+	/* Clear new context for now */
+	memset(&mm->context, 0, sizeof(mm->context));
+
 	if (!mm_init(mm))
 		goto fail_nomem;