git: 029528221261 - releng/15.0 - jail: Don't double-free the current prison in kern_jail_set/get

The branch releng/15.0 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=029528221261c56a5c6480e897c861fc91583315

commit 029528221261c56a5c6480e897c861fc91583315
Author:     Jamie Gritton <jamie@FreeBSD.org>
AuthorDate: 2026-06-09 22:31:40 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-06-30 02:32:57 +0000

    jail: Don't double-free the current prison in kern_jail_set/get
    
    Approved by:    so
    Security:       FreeBSD-SA-26:38.jail
    Security:       CVE-2026-49419
    Reported by:    Yuxiang Yang, et al <yangyx22 at mails.tsinghua.edu.cn>
    Discussed with: markj
    
    (cherry picked from commit b52dc2067618fc73e8d4d20e4035d1a67a8b455d)
    (cherry picked from commit 4938fd9361b497241df8f442f1f87cc73ef81d6c)
---
 sys/kern/kern_jail.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
index 523b7e314a10..40b2d7a69e3e 100644
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -1097,14 +1097,17 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags)
 			 * Look up and create jails based on the
 			 * descriptor's prison.
 			 */
-			prison_free(mypr);
-			error = jaildesc_find(td, jfd_in, &mypr, NULL);
+			struct prison *jdpr;
+
+			error = jaildesc_find(td, jfd_in, &jdpr, NULL);
 			if (error != 0) {
 				vfs_opterror(opts, error == ENOENT ?
 				    "descriptor to dead jail" :
 				    "not a jail descriptor");
 				goto done_errmsg;
 			}
+			prison_free(mypr);
+			mypr = jdpr;
 			if ((flags & JAIL_CREATE) && mypr->pr_childmax == 0) {
 				error = EPERM;
 				goto done_free;
@@ -2545,14 +2548,17 @@ kern_jail_get(struct thread *td, struct uio *optuio, int flags)
 		}
 		if (flags & JAIL_AT_DESC) {
 			/* Look up jails based on the descriptor's prison. */
-			prison_free(mypr);
-			error = jaildesc_find(td, jfd_in, &mypr, NULL);
+			struct prison *jdpr;
+
+			error = jaildesc_find(td, jfd_in, &jdpr, NULL);
 			if (error != 0) {
 				vfs_opterror(opts, error == ENOENT ?
 				    "descriptor to dead jail" :
 				    "not a jail descriptor");
 				goto done;
 			}
+			prison_free(mypr);
+			mypr = jdpr;
 		}
 		if (flags & (JAIL_GET_DESC | JAIL_OWN_DESC)) {
 			/* Allocate a jail descriptor to return later. */