From owner-freebsd-hackers@FreeBSD.ORG  Sat Aug 21 07:28:55 2004
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 04FBD16A4CE
	for <hackers@freebsd.org>; Sat, 21 Aug 2004 07:28:55 +0000 (GMT)
Received: from pimout1-ext.prodigy.net (pimout1-ext.prodigy.net
	[207.115.63.77])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B656043D2F
	for <hackers@freebsd.org>; Sat, 21 Aug 2004 07:28:54 +0000 (GMT)
	(envelope-from julian@elischer.org)
Received: from elischer.org (adsl-68-124-233-133.dsl.snfc21.pacbell.net
	[68.124.233.133])i7L7Sqhh061584;	Sat, 21 Aug 2004 03:28:52 -0400
Message-ID: <4126F9B3.8050900@elischer.org>
Date: Sat, 21 Aug 2004 00:28:51 -0700
From: Julian Elischer <julian@elischer.org>
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.4b) Gecko/20030524
X-Accept-Language: en, hu
MIME-Version: 1.0
To: Ted Unangst <tedu@coverity.com>
References: <41263E77.5040500@coverity.com>
In-Reply-To: <41263E77.5040500@coverity.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: hackers@freebsd.org
Subject: Re: use after free bugs
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 21 Aug 2004 07:28:55 -0000

Ted Unangst wrote:
> these are results from running Coverity's analysis over Freebsd 4.10 
> kernel.
> two improper loops:
> if_ef.c:566 and atapi-all.c
> 
> ng_socket.c:  possible double free of resp 815 and 870, depending on 
> caller context.  is this possible?
> 

I'm not seeing it..

Can you show the lines in the version that is being examined?
(So I can be sure I'm looking at the right code)
(and how do I interpret the above report?  815 and 870 are freeing different 
things.)

> if_bfe.c: double call to bfe_release_resources will free lots of stuff 
> twice on failure.
> 
> aha_isa.c: aha_isa_attach:  aha_free free "aha", can't use it 
> afterwards, lots of examples.
> 
> _______________________________________________
> freebsd-hackers@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
> To unsubscribe, send any mail to "freebsd-hackers-unsubscribe@freebsd.org"