[Bug 255869] [PATCH] kern: Fix a use after free bug in sodealloc

From: <bugzilla-noreply_at_freebsd.org>
Date: Mon, 17 May 2021 18:14:01 +0000
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=255869

Mark Johnston <markj_at_FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |markj_at_FreeBSD.org
             Status|New                         |Open
           Assignee|bugs_at_FreeBSD.org            |markj_at_FreeBSD.org

--- Comment #1 from Mark Johnston <markj_at_FreeBSD.org> ---
I think this is not formally correct.  The uidinfo structure itself is
protected by a reference count which is owned by the cred reference.  Really we
should simply defer the crfree() call to until after the chgsbsize() calls.

-- 
You are receiving this mail because:
You are the assignee for the bug.
Received on Mon May 17 2021 - 18:14:01 UTC

Original text of this message