From 4575a939b95321a62ddf8ecfefd3c7852091bcc5 Mon Sep 17 00:00:00 2001 From: Kirill Korotaev Date: Sat, 1 Apr 2006 16:06:50 -0800 Subject: [PATCH] wrong error path in dup_fd() leading to oopses in RCU Wrong error path in dup_fd() - it should return NULL on error, not an address of already freed memory :/ Triggered by OpenVZ stress test suite. What is interesting is that it was causing different oopses in RCU like below: Call Trace: [] rcu_do_batch+0x2c/0x80 [] rcu_process_callbacks+0x3d/0x70 [] tasklet_action+0x73/0xe0 [] __do_softirq+0x10a/0x130 [] do_softirq+0x4f/0x60 ======================= [] smp_apic_timer_interrupt+0x77/0x110 [] apic_timer_interrupt+0x1c/0x24 Code: Bad EIP value. <0>Kernel panic - not syncing: Fatal exception in interrupt Signed-Off-By: Pavel Emelianov Signed-Off-By: Dmitry Mishin Signed-Off-By: Kirill Korotaev Signed-Off-By: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/fork.c b/kernel/fork.c index b373322ca497..9d4e0d8b65e6 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -720,7 +720,7 @@ out_release: free_fdset (new_fdt->open_fds, new_fdt->max_fdset); free_fd_array(new_fdt->fd, new_fdt->max_fds); kmem_cache_free(files_cachep, newf); - goto out; + return NULL; } static int copy_files(unsigned long clone_flags, struct task_struct * tsk) -- cgit v1.2.3