[Bug 255869] [PATCH] kern: Fix a use after free bug in sodealloc
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 17 May 2021 18:14:01 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255869
Mark Johnston <markj@FreeBSD.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |markj@FreeBSD.org
Status|New |Open
Assignee|bugs@FreeBSD.org |markj@FreeBSD.org
--- Comment #1 from Mark Johnston <markj@FreeBSD.org> ---
I think this is not formally correct. The uidinfo structure itself is
protected by a reference count which is owned by the cred reference. Really we
should simply defer the crfree() call to until after the chgsbsize() calls.
--
You are receiving this mail because:
You are the assignee for the bug.