d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

kern_dup(): Call filecaps_free_prep() in a write section.

Browse Source 
filecaps_free_prep() bzeros the capabilities structure and we need to be
careful to synchronize with unlocked readers, which expect a consistent
rights structure.

Reviewed by:	kib, mjg
Reported by:	syzbot+5f30b507f91ddedded21@syzkaller.appspotmail.com
MFC after:	2 weeks
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D24120
This commit is contained in:
Mark Johnston 2020-03-19 15:40:05 +00:00
parent 2d896b816b
commit 429537caeb
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=359133
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/kern/kern_descrip.c
View File

@ -968,7 +968,6 @@ kern_dup(struct thread *td, u_int mode, int flags, int old, int new)
newfde = &fdp->fd_ofiles[new];
delfp = newfde->fde_file;
oioctls = filecaps_free_prep(&newfde->fde_caps);
nioctls = filecaps_copy_prep(&oldfde->fde_caps);
/*
@ -977,6 +976,7 @@ kern_dup(struct thread *td, u_int mode, int flags, int old, int new)
#ifdef CAPABILITIES
seqc_write_begin(&newfde->fde_seqc);
#endif
oioctls = filecaps_free_prep(&newfde->fde_caps);
memcpy(newfde, oldfde, fde_change_size);
filecaps_copy_finish(&oldfde->fde_caps, &newfde->fde_caps,
nioctls);