Re: use after free bugs

2004-08-24 Thread Ted Unangst
M. Warner Losh wrote: In message: [EMAIL PROTECTED] Ted Unangst [EMAIL PROTECTED] writes: : aha_isa.c: aha_isa_attach: aha_free free aha, can't use it : afterwards, lots of examples. aha_free doesn't actually free the aha, it just tears down the dma for the device. So the sturct

Re: use after free bugs

2004-08-24 Thread Ted Unangst
Julian Elischer wrote: Ted Unangst wrote: these are results from running Coverity's analysis over Freebsd 4.10 kernel. two improper loops: if_ef.c:566 and atapi-all.c ng_socket.c: possible double free of resp 815 and 870, depending on caller context. is this possible? I'm not seeing it.. Can

Re: use after free bugs

2004-08-23 Thread M. Warner Losh
In message: [EMAIL PROTECTED] Ted Unangst [EMAIL PROTECTED] writes: : M. Warner Losh wrote: : In message: [EMAIL PROTECTED] : Ted Unangst [EMAIL PROTECTED] writes: : : aha_isa.c: aha_isa_attach: aha_free free aha, can't use it : : afterwards, lots of examples. : :

Re: use after free bugs

2004-08-22 Thread M. Warner Losh
In message: [EMAIL PROTECTED] Ted Unangst [EMAIL PROTECTED] writes: : aha_isa.c: aha_isa_attach: aha_free free aha, can't use it : afterwards, lots of examples. aha_free doesn't actually free the aha, it just tears down the dma for the device. So the sturct aha_softc * that's

Re: use after free bugs

2004-08-21 Thread Julian Elischer
Ted Unangst wrote: these are results from running Coverity's analysis over Freebsd 4.10 kernel. two improper loops: if_ef.c:566 and atapi-all.c ng_socket.c: possible double free of resp 815 and 870, depending on caller context. is this possible? I'm not seeing it.. Can you show the lines in

use after free bugs

2004-08-20 Thread Ted Unangst
these are results from running Coverity's analysis over Freebsd 4.10 kernel. two improper loops: if_ef.c:566 and atapi-all.c ng_socket.c: possible double free of resp 815 and 870, depending on caller context. is this possible? if_bfe.c: double call to bfe_release_resources will free lots of

Re: use after free bugs

2004-02-21 Thread Robert Watson
On Fri, 20 Feb 2004, John Baldwin wrote: On Thursday 19 February 2004 08:43 pm, Ted Unangst wrote: Hi. These are some bugs found by Coverity in a static analysis run on the FreeBSD kernel. All these are use after free bugs. Thanks for the excellent bug reports! I wonder if the same

Re: use after free bugs

2004-02-21 Thread Kip Macy
I wonder if the same approach relating to memory allocation and free checking via static analysis could be applied to locking and unlocking of locks? I.e.: Yes. See Dawson's papers. That is one of the examples given. Use after free is one of the stock checkers. I don't think that there is

Re: use after free bugs

2004-02-20 Thread John Baldwin
On Thursday 19 February 2004 08:43 pm, Ted Unangst wrote: Hi. These are some bugs found by Coverity in a static analysis run on the FreeBSD kernel. All these are use after free bugs. Thanks for the excellent bug reports! -- John Baldwin [EMAIL PROTECTED]http://www.FreeBSD.org/~jhb

Re: use after free bugs

2004-02-20 Thread Colin Percival
At 18:40 20/02/2004, John Baldwin wrote: On Thursday 19 February 2004 08:43 pm, Ted Unangst wrote: Hi. These are some bugs found by Coverity in a static analysis run on the FreeBSD kernel. All these are use after free bugs. Thanks for the excellent bug reports! For what it's worth, I've now

use after free bugs

2004-02-19 Thread Ted Unangst
Hi. These are some bugs found by Coverity in a static analysis run on the FreeBSD kernel. All these are use after free bugs. # New errors. # - [UNINSPECTED] X [BUG] X [FALSE] X