[Bug 237368] /bin/df ; df on more than one unmounted device coredumps

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=237368

            Bug ID: 237368
           Summary: /bin/df ; df on more than one unmounted device
                    coredumps
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs at FreeBSD.org
          Reporter: jamie at catflap.org

I realise "df on unmountd devices is deprecated", but even so, as it stands,
there appears to be an invalid free, which causes coredump.

/usr/src/bin/df/df.c:

Line 276 and 277:

if (iov != NULL)
     free_iovec(&iov, &iovlen);

This is called prior to building the mount structure for nmount. If the
structure has been used before, it tries to free it, but causes a coredump in
the process.

To reproduce, run df on 2 or more unmounted devices (you don't actually need a
real unmounted device to trigger the bug, simply doing "df /dev/*" will trigger
the above codepath.

[ I tagged this "current" because it still occurs in current, but it's in
12-stable too ]

cheers, Jamie

-- 
You are receiving this mail because:
You are the assignee for the bug.