diff options
| author | gordon <gordon@FreeBSD.org> | 2019-07-24 12:55:16 +0000 |
|---|---|---|
| committer | gordon <gordon@FreeBSD.org> | 2019-07-24 12:55:16 +0000 |
| commit | add26e3d7b39aeb5e74011bd8d3d74c946771e8a (patch) | |
| tree | 2fbc0a1e13be8b173dcad27aaeafa2458e325e36 | |
| parent | c9f55f4afeb8674e5bcc7888c2b7288937a25ea4 (diff) | |
| download | FreeBSD-src-add26e3d7b39aeb5e74011bd8d3d74c946771e8a.zip FreeBSD-src-add26e3d7b39aeb5e74011bd8d3d74c946771e8a.tar.gz | |
Fix reference count overflow in mqueuefs.
Approved by: so
Security: FreeBSD-SA-19:15.mqueuefs
Security: CVE-2019-5603
| -rw-r--r-- | sys/kern/uipc_mqueue.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/sys/kern/uipc_mqueue.c b/sys/kern/uipc_mqueue.c index 5df97d7..994c530 100644 --- a/sys/kern/uipc_mqueue.c +++ b/sys/kern/uipc_mqueue.c @@ -2266,13 +2266,14 @@ sys_kmq_timedreceive(struct thread *td, struct kmq_timedreceive_args *uap) if (uap->abs_timeout != NULL) { error = copyin(uap->abs_timeout, &ets, sizeof(ets)); if (error != 0) - return (error); + goto out; abs_timeout = &ets; } else abs_timeout = NULL; waitok = !(fp->f_flag & O_NONBLOCK); error = mqueue_receive(mq, uap->msg_ptr, uap->msg_len, uap->msg_prio, waitok, abs_timeout); +out: fdrop(fp, td); return (error); } @@ -2291,13 +2292,14 @@ sys_kmq_timedsend(struct thread *td, struct kmq_timedsend_args *uap) if (uap->abs_timeout != NULL) { error = copyin(uap->abs_timeout, &ets, sizeof(ets)); if (error != 0) - return (error); + goto out; abs_timeout = &ets; } else abs_timeout = NULL; waitok = !(fp->f_flag & O_NONBLOCK); error = mqueue_send(mq, uap->msg_ptr, uap->msg_len, uap->msg_prio, waitok, abs_timeout); +out: fdrop(fp, td); return (error); } @@ -2815,7 +2817,7 @@ freebsd32_kmq_timedreceive(struct thread *td, if (uap->abs_timeout != NULL) { error = copyin(uap->abs_timeout, &ets32, sizeof(ets32)); if (error != 0) - return (error); + goto out; CP(ets32, ets, tv_sec); CP(ets32, ets, tv_nsec); abs_timeout = &ets; @@ -2824,6 +2826,7 @@ freebsd32_kmq_timedreceive(struct thread *td, waitok = !(fp->f_flag & O_NONBLOCK); error = mqueue_receive(mq, uap->msg_ptr, uap->msg_len, uap->msg_prio, waitok, abs_timeout); +out: fdrop(fp, td); return (error); } |
