paste02-talk

L 4l9 a 8 r d m h n

Info iconThis preview shows page 1. Sign up to view the full content.

View Full Document Right Arrow Icon
This is the end of the preview. Sign up to access the rest of the document.

Unformatted text preview: '#) 3 '2) . R '3 " " D > SS < $ ) T.L ? > 4L9 : ; #$ ) ' ; R & R '3 " " D > SS < $) T. L ? > 4L9 + + + : " 'A) '> ''' 8 R & ' ) D >M + & H'") % )N U , / ( B ' N( 8 V ' ' ) ) F 'E & + 3 ' , (E 8E ' '. '! D ! ## '8 ) ## '8 ' 'L ) ( N '#% )U' % ) = ' N N'# % ))( E ,! , T )O T N ) O = ' N(@N(2) + (@ , ) . 'H '8 ! ! ') % , , D >M sm free_checker { state decl any_pointer v; decl any_pointer x; ! + '' '. '. ! , , , ') N , ') ') N N ' ' . ( (" ( 'A" A) < ' ! 2A ( ') $ ') $ !' ( 'A" #) " ## ) " K ') N start: { kfree(v); } ==> v.freed ; v.freed: { v != x } || { v == x } ==> { /* do nothing */ } | { v } ==> { err(“Use after free!”); } ; } ) , I ) B sm free_checker local { state decl any_pointer v; decl any_fn_call call; decl any_pointer x; ) Kfree[0]: 2623 checks, 60 errors, z= 48.87 2.4.1/drivers/sound/sound_core.c:sound_insert_unit: ERROR:171:178: Use-after-free of 's'! set by 'kfree‘ ... kfree_skb[0]: 1070 checks, 13 errors, z = 31.92 start: { call(v) } ==> v.freed, { mc_v_set_data(v, mc_identifier(call)); v_note(“checking [POP=$data]”, v); } ; v.freed: { v != x } || { v == x } ==> { /* do nothing */ } | { v } ==> { v_err(“Use after free! [FAIL=$data]”, v); } ; } 2.4.1/drivers/net/wan/comx-proto-fr.c:fr_xmit: ERROR:508:510: Use-after-free of 'skb'! set by 'kfree_skb‘ ... [FALSE] page_cache_release[0] ex=117, counter=3, z = 10.3 dev_kfree_skb[0]: 109 checks, 4 errors, z=9.67 2.4.1/drivers/atm/iphase.c:rx_dle_intr: ERROR:1321:1323: Use-after-free of 'skb'! set...
View Full Document

This note was uploaded on 12/28/2013 for the course CS 190 taught by Professor Engler during the Winter '12 term at Stanford.

Ask a homework question - tutors are online