freebsd-skq/sys
Mateusz Guzik a03f1b2970 vfs: plug a use-after-free of fd_rdir in namei
fd_rdir vnode was stored in ni_rootdir without refing it in any way,
after which the filedsc lock was being dropped.

The vnode could have been freed by mountcheckdirs or another thread doing
chroot.

VREF the vnode while the lock is held.

Reviewed by:	kib
MFC after:	1 week
2015-07-09 15:06:24 +00:00
..
amd64 Now that aesni won't reuse fpu contexts (D3016), add seatbelts to the 2015-07-08 19:26:36 +00:00
arm Add the atomic_thread_fence() family of functions with intent to 2015-07-08 18:12:24 +00:00
arm64 Add support for SMP. This uses the FDT data to find the CPUs to start on, 2015-07-09 13:23:29 +00:00
boot Add the Banana Pi DTS. 2015-07-07 19:01:54 +00:00
bsm
cam Make first step toward supporting target and initiator roles same time. 2015-07-05 03:38:58 +00:00
cddl fd: make 'rights' a manadatory argument to fget* functions 2015-07-05 19:05:16 +00:00
compat Generate CloudABI system call table with proper $FreeBSD$ tags. 2015-07-09 07:21:33 +00:00
conf Add support for SMP. This uses the FDT data to find the CPUs to start on, 2015-07-09 13:23:29 +00:00
contrib Import the CloudABI datatypes and create a system call table. 2015-07-09 07:20:15 +00:00
crypto upon further examination, it turns out that _unregister_all already 2015-07-08 22:48:41 +00:00
ddb Correct the function name in catch-all error handling case. 2015-06-17 10:20:59 +00:00
dev Attempt to make 5GHz HT/40 work on the 6xxx series NICs. 2015-07-07 03:51:29 +00:00
fs Check suspendability on the mountpoint returned by VOP_GETWRITEMOUNT. 2015-07-05 22:37:33 +00:00
gdb CALLOUT_MPSAFE has lost its meaning since r141428, i.e., for more than ten 2015-05-22 17:05:21 +00:00
geom Properly propagate errors in metadata reading. 2015-07-02 10:57:34 +00:00
gnu
i386 Now that aesni won't reuse fpu contexts (D3016), add seatbelts to the 2015-07-08 19:26:36 +00:00
isa
kern vfs: plug a use-after-free of fd_rdir in namei 2015-07-09 15:06:24 +00:00
kgssapi
libkern Huge cleanup of random(4) code. 2015-06-30 17:00:45 +00:00
mips Add the atomic_thread_fence() family of functions with intent to 2015-07-08 18:12:24 +00:00
modules Add the Banana Pi DTS. 2015-07-07 19:01:54 +00:00
net Fix if_loop so bpfwrite() can use it regardless of the state of 2015-07-06 02:12:49 +00:00
net80211 Break out the current 802.11 software scan methods into an indirect table. 2015-06-08 02:35:43 +00:00
netgraph Fix rfcomm_sppd regression I could reproduced. 2015-07-07 15:56:51 +00:00
netinet Export the ssthresh value per SCTP path via the sysctl interface. 2015-07-07 06:34:28 +00:00
netinet6 Keep IPv6 address specified by IPV6_PKTINFO socket option in kernel 2015-07-03 19:01:38 +00:00
netipsec Fill the port and protocol information in the SADB_ACQUIRE message 2015-07-06 12:40:31 +00:00
netnatm
netpfil ALTQ FAIRQ discipline import from DragonFLY 2015-06-24 19:16:41 +00:00
netsmb
nfs
nfsclient
nfsserver
nlm
ofed Fix broken implementation of "kvasprintf()" function by adding missing 2015-07-03 11:16:20 +00:00
opencrypto we may get here w/ non-sleepable locks held, so switch to _NOWAIT when 2015-07-07 18:45:32 +00:00
pc98 Fix up tabs vs. spaces 2015-07-04 20:31:06 +00:00
powerpc Add the atomic_thread_fence() family of functions with intent to 2015-07-08 18:12:24 +00:00
rpc
security fd: make 'rights' a manadatory argument to fget* functions 2015-07-05 19:05:16 +00:00
sparc64 Add the atomic_thread_fence() family of functions with intent to 2015-07-08 18:12:24 +00:00
sys Add forward declaration of struct thread. 2015-07-09 07:31:40 +00:00
teken
tools
ufs Check suspendability on the mountpoint returned by VOP_GETWRITEMOUNT. 2015-07-05 22:37:33 +00:00
vm The intention of r254304 was to scan the active queue continuously. 2015-07-08 17:45:59 +00:00
x86 Set the initial system time to a sane (as in: not end of 21st century) value when 2015-06-29 17:02:09 +00:00
xdr
xen Garbage collect comments which related to the pre-r284296 support for a 2015-06-21 06:05:33 +00:00
Makefile Kill EoL whitespace. 2015-05-29 14:03:07 +00:00