d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Clear the pointers to the file in the struct filedesc before file is closed

Browse Source 
in fdfree. Otherwise, sysctl_kern_proc_filedesc may dereference stale
struct file * values.

Reported and tested by:	pho
MFC after:	1 month
This commit is contained in:
Konstantin Belousov 2008-12-30 12:51:56 +00:00
parent 83e73926ad
commit 7efa697d80
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=186601
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/kern/kern_descrip.c
View File

@ -1703,14 +1703,16 @@ fdfree(struct thread *td)
FILEDESC_XUNLOCK(fdp);
if (i > 0)
return;
/*
* We are the last reference to the structure, so we can
* safely assume it will not change out from under us.
*/
fpp = fdp->fd_ofiles;
for (i = fdp->fd_lastfile; i-- >= 0; fpp++) {
if (*fpp)
(void) closef(*fpp, td);
if (*fpp) {
FILEDESC_XLOCK(fdp);
fp = *fpp;
*fpp = NULL;
FILEDESC_XUNLOCK(fdp);
(void) closef(fp, td);
}
}
FILEDESC_XLOCK(fdp);