free magic is broken

[Vincent Guffens]

Hi,

I have made a small test program that uses the memory management of grub2 to
manage an allocated buffer and I can reproduce the free magic is broken
problem  with it.

I have prepared a small web page with some details as it is a little bit long
to explain here. See it there if you want more information:

http://www.auto.ucl.ac.be/~guffens/grub2_netboot/free_magic_broken.html

I propose the following patch to fix this problem. This patch will modify the
mm code of grub2 only when the problem would occur in subsequent call to
grub_free:

diff -ru grub2/kern/mm.c grub2_free_magic_broken/kern/mm.c
--- grub2/kern/mm.c     2005-01-20 18:25:39.000000000 +0100
+++ grub2_free_magic_broken/kern/mm.c   2005-06-22 22:59:58.660577232 +0200
@@ -298,6 +298,10 @@
          p->next->magic = 0;
          p->size += p->next->size;
          p->next = p->next->next;
+         if (q->magic != GRUB_MM_FREE_MAGIC) {
+           r->first = p;
+           return;
+         }
        }

       if (q + q->size == p)








--
         Vincent Guffens
         UCL/CESAME  +32 10 47 80 30 
         Euler Building A017