diff options
| author | nectar <nectar@FreeBSD.org> | 2004-02-05 18:00:35 +0000 |
|---|---|---|
| committer | nectar <nectar@FreeBSD.org> | 2004-02-05 18:00:35 +0000 |
| commit | 6eba071b9aa24afac0eb127c85081615fd791a9a (patch) | |
| tree | 27f8ae0f3f4c6f6c694f1e03328638b2d3c70109 /sys | |
| parent | d9a02c577afb6c93dc8ca496fa7f5b74b198244d (diff) | |
| download | FreeBSD-src-6eba071b9aa24afac0eb127c85081615fd791a9a.zip FreeBSD-src-6eba071b9aa24afac0eb127c85081615fd791a9a.tar.gz | |
Correct a reference counting bug in shmat(2). If vm_map_find(9)
failed, the reference count for the virtual memory object referenced
by the specified shared memory segment would have been erroneously
incremented.
Reported by: Joost Pol <joost@pine.nl>
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/kern/sysv_shm.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/kern/sysv_shm.c b/sys/kern/sysv_shm.c index 32663e4..80fa0de 100644 --- a/sys/kern/sysv_shm.c +++ b/sys/kern/sysv_shm.c @@ -378,6 +378,7 @@ kern_shmat(td, shmid, shmaddr, shmflg) rv = vm_map_find(&p->p_vmspace->vm_map, shm_handle->shm_object, 0, &attach_va, size, (flags & MAP_FIXED)?0:1, prot, prot, 0); if (rv != KERN_SUCCESS) { + vm_object_deallocate(shm_handle->shm_object); error = ENOMEM; goto done2; } |
