]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
file: Avoid a read-after-free of fd tables in sysctl handlers
authorMark Johnston <markj@FreeBSD.org>
Thu, 17 Mar 2022 16:54:37 +0000 (12:54 -0400)
committerMark Johnston <markj@FreeBSD.org>
Thu, 31 Mar 2022 15:32:00 +0000 (11:32 -0400)
commiteef123d5fd97ef6d5c236f6420c1901b7e19499f
tree9d9540697055a142292be050542c88441950b76b
parent7be0c792c46c5a1faf46b611058953aa85b192d6
file: Avoid a read-after-free of fd tables in sysctl handlers

Some loops access the fd table of a different process, and drop the
filedesc lock while iterating, so they check the table's refcount.
However, we access the table before the first iteration, in order to get
the number of table entries, and this access can be a use-after-free.

Fix the problem by checking the refcount before we start iterating.

Reported by: pho
Reviewed by: mjg
Sponsored by: The FreeBSD Foundation

(cherry picked from commit c70224229205c756bf1c2007a6b96b37126eb047)
sys/kern/kern_descrip.c