Skip to content

Commit

Permalink
shmem: don't unmap a memrory region in restore_shmem_content()
Browse files Browse the repository at this point in the history
This function doesn't allocate memory, so it should not release it.

CID 73380 (#1 of 1): Use after free (USE_AFTER_FREE)
14. deref_arg: Calling munmap dereferences freed pointer addr.
  • Loading branch information
avagin committed Oct 31, 2014
1 parent ff521e2 commit 41e476e
Showing 1 changed file with 1 addition and 4 deletions.
5 changes: 1 addition & 4 deletions shmem.c
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ static int restore_shmem_content(void *addr, struct shmem_info *si)

ret = open_page_read(si->shmid, &pr, opts.auto_dedup ? O_RDWR : O_RSTR, true);
if (ret)
goto err_unmap;
return -1;

fd_pg = img_raw_fd(pr.pi);
while (1) {
Expand Down Expand Up @@ -168,9 +168,6 @@ static int restore_shmem_content(void *addr, struct shmem_info *si)

pr.close(&pr);
return ret;
err_unmap:
munmap(addr, si->size);
return -1;
}

int get_shmem_fd(int pid, VmaEntry *vi)
Expand Down

0 comments on commit 41e476e

Please sign in to comment.