On Thu, Feb 27, 2014 at 09:06:31AM -0500, John Baldwin wrote:
> On Wednesday, February 26, 2014 4:22:00 pm Mateusz Guzik wrote:
> > On Wed, Feb 26, 2014 at 03:29:31PM -0500, John Baldwin wrote:
> > > On Wednesday, February 26, 2014 2:23:48 pm Mateusz Guzik wrote:
> > > > Other thing is that with th
On Wednesday, February 26, 2014 4:22:00 pm Mateusz Guzik wrote:
> On Wed, Feb 26, 2014 at 03:29:31PM -0500, John Baldwin wrote:
> > On Wednesday, February 26, 2014 2:23:48 pm Mateusz Guzik wrote:
> > > On Tue, Feb 25, 2014 at 01:08:43PM -0500, John Baldwin wrote:
> > > > On Friday, February 21, 201
On Wed, Feb 26, 2014 at 03:29:31PM -0500, John Baldwin wrote:
> On Wednesday, February 26, 2014 2:23:48 pm Mateusz Guzik wrote:
> > On Tue, Feb 25, 2014 at 01:08:43PM -0500, John Baldwin wrote:
> > > On Friday, February 21, 2014 5:29:09 pm Mateusz Guzik wrote:
> > > > Author: mjg
> > > > Date: Fri
On Wednesday, February 26, 2014 2:23:48 pm Mateusz Guzik wrote:
> On Tue, Feb 25, 2014 at 01:08:43PM -0500, John Baldwin wrote:
> > On Friday, February 21, 2014 5:29:09 pm Mateusz Guzik wrote:
> > > Author: mjg
> > > Date: Fri Feb 21 22:29:09 2014
> > > New Revision: 262309
> > > URL: http://svnweb
On Tue, Feb 25, 2014 at 01:08:43PM -0500, John Baldwin wrote:
> On Friday, February 21, 2014 5:29:09 pm Mateusz Guzik wrote:
> > Author: mjg
> > Date: Fri Feb 21 22:29:09 2014
> > New Revision: 262309
> > URL: http://svnweb.freebsd.org/changeset/base/262309
> >
> > Log:
> > Fix a race between ke
On Friday, February 21, 2014 5:29:09 pm Mateusz Guzik wrote:
> Author: mjg
> Date: Fri Feb 21 22:29:09 2014
> New Revision: 262309
> URL: http://svnweb.freebsd.org/changeset/base/262309
>
> Log:
> Fix a race between kern_proc_{o,}filedesc_out and fdescfree leading
> to use-after-free.
>
>
Author: mjg
Date: Fri Feb 21 22:29:09 2014
New Revision: 262309
URL: http://svnweb.freebsd.org/changeset/base/262309
Log:
Fix a race between kern_proc_{o,}filedesc_out and fdescfree leading
to use-after-free.
fdescfree proceeds to free file pointers once fd_refcnt reaches 0, but
kern_pr