From nobody Tue Oct 06 17:34:00 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hzjzX3k8mz4nGS4 for ; Tue, 06 Oct 2026 17:34:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hzjzX38Vkz3H3S for ; Tue, 06 Oct 2026 17:34:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791308040; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QeZvETy9CsoE6K2xGREBN27K4iSROa43eynzTXjIHck=; b=vyuJ9GedYWlIHWvGbk04gFO7zwFoDpQHrHj/Wsj23UaOrCI32h3osb1f3ZddFc4UamrxTa VwHm+XCu/c/Pj7wAG8kxg/kNe6xgyOWn2toYN5bM6f8Qc4lCp6GZNmDUcQx5Fl5XogBAGI qpwVQ3Msexi0ZsM8nx5Phe6jGK/NiurOwqsTnv6M3xtoDr91Y45vfUW/qRnV1epGUtAhRB RwIFwKYFxbGeMuF57pUFImjV6GgyRcQEsN8QeRjAH2DSSSr0SMFVbkQd2FVGLvo0159YV2 b37YHUWMS3NhaLE1pPJgJx90Jiuzh6IHutsZyzc5u6m6ZTd0iSi5xQGl7a41eA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791308040; b=WWnKGym6eN6qD/BS/oBgY5ZvJ9MXSWMk1ZL57RBahTQ3l7LGvSx65k9yjV+/JwZlgw4nHr MnHDIDAGYsrKzqd30KdZJwzadmR4PdJpWAAeZ+O7lt7tENbeG0z8Yo1k+3LKZtitId1TtI SJotUpe/ZGDP4hrCFV2crVXcyKDri/d6fNexwtEjWyzjz+IsM96H+OlCFz1tFjMCieSFCb NT8iX5HX6pnPgR06SsJ8jxkur1E/dCEDgtGoKLv/8fG7AF0ULkDrHVczG/eshHLFQ64kO+ 1AJmuX63x1QWot62+ucprBbxriM6GUP4+MSM7w+xqBtzsEIXS6L4/2ManDNiTQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791308040; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=QeZvETy9CsoE6K2xGREBN27K4iSROa43eynzTXjIHck=; b=ndnLF5KfYfs2tiiE7lUMTlan9MQ8f9vaAL9DWZK8T0wSC/erMUmujURc0JMo96GI76QSQv wh2pr60TbiMqstXSJUaPJraq2Xz8agkLAr71U8uOwxjFUF7A9Wj2Y7OE6XWxuZ23AoxeEq Nu9OxYd0UqWF61zrzht36ajmtbinAHlW7C4jYh//bTJb4BYKFkRwAR9ErnEIxRoE1PYMlZ ZGMVAIchHa8xPP3ykFskaUmlQZXgFb0fJrDkx/G9BAVsT31ZVwPYVgNFM9OyQOwcmO+Tqj yl6HZ8ThMEs2Jqc14y98kaMm64EwnezKQKHf1bB/m+qbvB8znnZ2vxJX1IhiEQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hzjzX2CkWzG5B for ; Tue, 06 Oct 2026 17:34:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 382a1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 06 Oct 2026 17:34:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Konstantin Belousov Subject: git: 274236ed084a - main - rtld.c: avoid double-free on dso load failure in do_load_object() List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kib X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 274236ed084a259a0e8a11df1afebd2f2f1fb097 Auto-Submitted: auto-generated Date: Tue, 06 Oct 2026 17:34:00 +0000 Message-Id: <6ac53108.382a1.1491be4b@gitrepo.freebsd.org> The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=274236ed084a259a0e8a11df1afebd2f2f1fb097 commit 274236ed084a259a0e8a11df1afebd2f2f1fb097 Author: Konstantin Belousov AuthorDate: 2026-10-06 08:22:21 +0000 Commit: Konstantin Belousov CommitDate: 2026-10-06 17:33:27 +0000 rtld.c: avoid double-free on dso load failure in do_load_object() The obj->path is assigned directly from the path argument, and load_object() frees the path on do_load_object() failure. Do not free it in obj_free() on the error path. Reviewed by: markj Sponsored by: The FreeBSD Foundation MFC after: 1 week Differential revision: https://reviews.freebsd.org/D60402 --- libexec/rtld-elf/rtld.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c index 850e017a404d..048cc473305a 100644 --- a/libexec/rtld-elf/rtld.c +++ b/libexec/rtld-elf/rtld.c @@ -3027,6 +3027,7 @@ do_load_object(int fd, const char *name, char *path, struct stat *sbp, errp: munmap(obj->mapbase, obj->mapsize); + obj->path = NULL; /* obj->path is owned and freed by caller */ obj_free(obj); return (NULL); }