From 3948f93fc83c9323caf1f8d15a2737efcd9f4381 Mon Sep 17 00:00:00 2001 From: mjg Date: Mon, 24 Feb 2014 21:03:38 +0000 Subject: MFC r262309: Fix a race between kern_proc_{o,}filedesc_out and fdescfree leading to use-after-free. fdescfree proceeds to free file pointers once fd_refcnt reaches 0, but kern_proc_{o,}filedesc_out only checked for hold count. --- sys/kern/kern_descrip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sys/kern/kern_descrip.c') diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c index f4ffd55..2b37f8f 100644 --- a/sys/kern/kern_descrip.c +++ b/sys/kern/kern_descrip.c @@ -3052,7 +3052,7 @@ sysctl_kern_proc_ofiledesc(SYSCTL_HANDLER_ARGS) if (fdp->fd_jdir != NULL) export_vnode_for_osysctl(fdp->fd_jdir, KF_FD_TYPE_JAIL, kif, fdp, req); - for (i = 0; i < fdp->fd_nfiles; i++) { + for (i = 0; fdp->fd_refcnt > 0 && i < fdp->fd_nfiles; i++) { if ((fp = fdp->fd_ofiles[i].fde_file) == NULL) continue; bzero(kif, sizeof(*kif)); @@ -3422,7 +3422,7 @@ kern_proc_filedesc_out(struct proc *p, struct sbuf *sb, ssize_t maxlen) export_fd_to_sb(data, KF_TYPE_VNODE, KF_FD_TYPE_JAIL, FREAD, -1, -1, NULL, efbuf); } - for (i = 0; i < fdp->fd_nfiles; i++) { + for (i = 0; fdp->fd_refcnt > 0 && i < fdp->fd_nfiles; i++) { if ((fp = fdp->fd_ofiles[i].fde_file) == NULL) continue; data = NULL; -- cgit v1.1