Re: use after free bugs

2004-08-24 Thread Ted Unangst
Julian Elischer wrote: Ted Unangst wrote: these are results from running Coverity's analysis over Freebsd 4.10 kernel. two improper loops: if_ef.c:566 and atapi-all.c ng_socket.c: possible double free of resp 815 and 870, depending on caller context. is this possible? I'm not seeing it.. Can

Re: use after free bugs

2004-08-24 Thread Ted Unangst
M. Warner Losh wrote: In message: <[EMAIL PROTECTED]> Ted Unangst <[EMAIL PROTECTED]> writes: : aha_isa.c: aha_isa_attach: aha_free free "aha", can't use it : afterwards, lots of examples. aha_free doesn't actually free the aha, it just tears down the dma for the device. So the stur

Re: use after free bugs

2004-08-23 Thread M. Warner Losh
In message: <[EMAIL PROTECTED]> Ted Unangst <[EMAIL PROTECTED]> writes: : M. Warner Losh wrote: : > In message: <[EMAIL PROTECTED]> : > Ted Unangst <[EMAIL PROTECTED]> writes: : > : aha_isa.c: aha_isa_attach: aha_free free "aha", can't use it : > : afterwards, lots of exam

Re: use after free bugs

2004-08-22 Thread M. Warner Losh
In message: <[EMAIL PROTECTED]> Ted Unangst <[EMAIL PROTECTED]> writes: : aha_isa.c: aha_isa_attach: aha_free free "aha", can't use it : afterwards, lots of examples. aha_free doesn't actually free the aha, it just tears down the dma for the device. So the sturct aha_softc * that's

Re: use after free bugs

2004-08-21 Thread Julian Elischer
Ted Unangst wrote: these are results from running Coverity's analysis over Freebsd 4.10 kernel. two improper loops: if_ef.c:566 and atapi-all.c ng_socket.c: possible double free of resp 815 and 870, depending on caller context. is this possible? I'm not seeing it.. Can you show the lines in t

use after free bugs

2004-08-20 Thread Ted Unangst
these are results from running Coverity's analysis over Freebsd 4.10 kernel. two improper loops: if_ef.c:566 and atapi-all.c ng_socket.c: possible double free of resp 815 and 870, depending on caller context. is this possible? if_bfe.c: double call to bfe_release_resources will free lots of stu

Re: use after free bugs

2004-02-21 Thread Kip Macy
> > I wonder if the same approach relating to memory allocation and free > checking via static analysis could be applied to locking and unlocking of > locks? I.e.: Yes. See Dawson's papers. That is one of the examples given. Use after free is one of the stock checkers. I don't think that there

Re: use after free bugs

2004-02-21 Thread Robert Watson
On Fri, 20 Feb 2004, John Baldwin wrote: > On Thursday 19 February 2004 08:43 pm, Ted Unangst wrote: > > Hi. These are some bugs found by Coverity in a static analysis run on the > > FreeBSD kernel. All these are use after free bugs. > > Thanks for the excellent bug repor

Re: use after free bugs

2004-02-20 Thread Colin Percival
At 18:40 20/02/2004, John Baldwin wrote: On Thursday 19 February 2004 08:43 pm, Ted Unangst wrote: > Hi. These are some bugs found by Coverity in a static analysis run on the > FreeBSD kernel. All these are use after free bugs. Thanks for the excellent bug reports! For what it's

Re: use after free bugs

2004-02-20 Thread John Baldwin
On Thursday 19 February 2004 08:43 pm, Ted Unangst wrote: > Hi. These are some bugs found by Coverity in a static analysis run on the > FreeBSD kernel. All these are use after free bugs. Thanks for the excellent bug reports! -- John Baldwin <[EMAIL PROTECTED]> <>< h

use after free bugs

2004-02-19 Thread Ted Unangst
Hi. These are some bugs found by Coverity in a static analysis run on the FreeBSD kernel. All these are use after free bugs. # New errors. # - [UNINSPECTED] X [BUG] X [FALSE] X