Project

General

Profile

Actions
Copy link

Bug #10755

closed

Double free for environment models

Added by Evgeny Novikov about 3 years ago. Updated about 3 years ago.

Status:
Closed
Priority:
Urgent
Assignee:
Ilja Zakharov
Category:
Environment models
Target version:
3.1
Start date:
03/15/2021
Due date:
% Done:

0%

Estimated time:
Detected in build:
git
Platform:
Published in build:

Description

Likely recent changes in EMG or/and environment model specifications resulted in CPAchecker SMG started to reveal double free for environment models. For me it looks strange that there are phrases like "Callback callback postcondition" (it is not clear what second word "callback" means). There are following drivers demonstrating such the behavior:
  1. drivers/hid/hid-a4tech.ko
  2. drivers/hid/hid-apple.ko
  3. drivers/hid/hid-corsair.ko
  4. drivers/hid/hid-elan.ko
  5. drivers/hid/hid-microsoft.ko
  6. drivers/hid/hid-saitek.ko
  7. drivers/hid/hid-zydacron.ko
  8. drivers/media/platform/sti/bdisp/bdisp.ko
  9. drivers/platform/chrome/wilco_ec/wilco_ec_debugfs.ko
  10. drivers/platform/x86/ideapad-laptop.ko
  11. drivers/platform/x86/intel_telemetry_debugfs.ko
  12. drivers/staging/greybus/gb-uart.ko
  13. drivers/usb/host/isp1362-hcd.ko
  14. drivers/usb/host/sl811-hcd.ko
  15. drivers/usb/typec/tcpm/fusb302.ko

Please, check that after a fix verification results will change for all mentioned drivers.

More unlikely this is a result of recent changes in CPAchecker SMG, but I am not sure in this.

Actions
Copy link
 #1

Updated by Ilja Zakharov about 3 years ago

  • Status changed from New to Resolved

Fixed in the fix-doublefree branch.

The issue was quite serious and old surprisingly. The fix is small but it changes quite important functions of the EMG component. Thus, thorough testing of the branch is recommended.

Actions
Copy link
 #2

Updated by Evgeny Novikov about 3 years ago

I got rid of a bug fix in the scheduler (#10677) that was in branch fix-doublefree in branch fix-double-free. The old branch fix-doublefree was deleted. The new branch undergoes testing.

Actions
Copy link
 #3

Updated by Evgeny Novikov about 3 years ago

  • Status changed from Resolved to Closed

The issue has gone. ~10% of false alarms became either Safes or Unknowns when checking memory safety for ~2000 drivers of Linux 5.5. For arch:.* there is not any noticibeable differences. I merged the branch to master in 6a705bf4a.

Actions
Copy link

Also available in: Atom PDF