Author: markj
Date: Fri Feb 12 20:43:53 2016
New Revision: 295574
URL: https://svnweb.freebsd.org/changeset/base/295574
Log:
Clear the cookie pointer on error in tmpfs_readdir().
It is otherwise left dangling, and callers that request cookies always free
the cookie buffer, even when VOP_READDIR(9) returns an error. This results
in a double free if tmpfs_readdir() returns an error to the NFS server or
the Linux getdents(2) emulation code.
Reported by: pho
MFC after: 1 week
Security: double free of malloc(9)-backed memory
Sponsored by: EMC / Isilon Storage Division
Modified:
head/sys/fs/tmpfs/tmpfs_vnops.c
Modified: head/sys/fs/tmpfs/tmpfs_vnops.c
==============================================================================
--- head/sys/fs/tmpfs/tmpfs_vnops.c Fri Feb 12 20:14:03 2016
(r295573)
+++ head/sys/fs/tmpfs/tmpfs_vnops.c Fri Feb 12 20:43:53 2016
(r295574)
@@ -1191,8 +1191,11 @@ tmpfs_readdir(struct vop_readdir_args *v
if (error == EJUSTRETURN)
error = (uio->uio_resid != startresid) ? 0 : EINVAL;
- if (error != 0 && cookies != NULL)
+ if (error != 0 && cookies != NULL && ncookies != NULL) {
free(*cookies, M_TEMP);
+ *cookies = NULL;
+ *ncookies = 0;
+ }
if (eofflag != NULL)
*eofflag =
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
