Re: double free() with grub-probe

[Jeroen Dekkers]

At Wed, 16 May 2007 22:01:01 +0200,
Robert Millan wrote:
> 
> We got this bug report from Debian BTS.  It seems to be related to LVM.
> 
> The argc address in last line looks very suspicious; stack corruption?

It's possible, but it can also be a compiler optimalisation that
confuses gdb.
 
> > Program received signal SIGABRT, Aborted.
> > 0xffffe410 in __kernel_vsyscall ()
> > (gdb) bt
> > #0  0xffffe410 in __kernel_vsyscall ()
> > #1  0xb7dfcd60 in raise () from /lib/i686/cmov/libc.so.6
> > #2  0xb7dfe5b1 in abort () from /lib/i686/cmov/libc.so.6
> > #3  0xb7e3308b in __libc_message () from /lib/i686/cmov/libc.so.6
> > #4  0xb7e3aeed in _int_free () from /lib/i686/cmov/libc.so.6
> > #5  0xb7e3e530 in free () from /lib/i686/cmov/libc.so.6
> > #6  0x0804bc8f in grub_disk_read (disk=0x8064078, sector=4000189, offset=0, 
> > size=194560, buf=0xb7da2008 "")
> >     at kern/disk.c:480

That's the free of tmp_buf, but I just looked at the code and as far
as I can see the only place where tmp_buf can get freed is at that
place. So I'm a bit puzzled how a double free() can happen there.

Jeroen Dekkers