shaba/lvm2
1
0
Fork 0
mirror of git://sourceware.org/git/lvm2.git synced 2024-12-21 13:34:40 +03:00
Code Releases Activity

libdm: only free the first histogram explicitly (Coverity)

Browse Source 
Coverity flags a user-after-free in _stats_histograms_destroy():

>>>     Calling "dm_pool_free" frees pointer "mem->chunk" which has
>>>     already been freed.

This should not be possible since the histograms are destroyed in
reverse order of allocation:

 203         for (n = _nr_areas_region(region) - 1; n; n--)
 204                 if (region->counters[n].histogram)
 205                         dm_pool_free(mem, region->counters[n].histogram);

It appears that Coverity is unaware that pool->chunk is updated
during the call to dm_pool_free() and valgrind flags no errors in
this function when called with multiple allocated histograms.

Since there is no actual need to free the histograms individually
in this way simplify the code and just free the first allocated
object (which will also free all later allocated histograms in a
single call).
This commit is contained in:
Bryn M. Reeves 2015-09-07 17:53:56 +01:00
parent ffbf12504d
commit 4bc7a86f3a
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libdm/libdm-stats.c
View File

@ -200,9 +200,11 @@ static void _stats_histograms_destroy(struct dm_pool *mem,
if (!region->counters)
return;
for (n = _nr_areas_region(region) - 1; n; n--)
if (region->counters[n].histogram)
dm_pool_free(mem, region->counters[n].histogram);
/*
* Only the first histogram needs to be freed explicitly.
*/
if (region->counters[0].histogram)
dm_pool_free(mem, region->counters[0].histogram);
}
static void _stats_region_destroy(struct dm_stats_region *region)