svn commit: r345272 - stable/12/sys/fs/ext2fs

[Fedor Uporov]

Author: fsu
Date: Mon Mar 18 12:34:13 2019
New Revision: 345272
URL: https://svnweb.freebsd.org/changeset/base/345272

Log:
  MFC: r344757:
  Fix double free in case of mount error.
  
  Reported by:    Christopher Krah, Thomas Barabosch, and Jan-Niclas Hilgert of Fraunhofer FKIE
  Reported as:    FS-9-EXT3-2: Denial Of Service in nmount-5 (vm_fault_hold)
  Reviewed by:    pfg
  
  Differential Revision:    https://reviews.freebsd.org/D19385

Modified:
  stable/12/sys/fs/ext2fs/ext2_vfsops.c

Modified: stable/12/sys/fs/ext2fs/ext2_vfsops.c
==============================================================================
--- stable/12/sys/fs/ext2fs/ext2_vfsops.c	Mon Mar 18 12:31:07 2019	(r345271)
+++ stable/12/sys/fs/ext2fs/ext2_vfsops.c	Mon Mar 18 12:34:13 2019	(r345272)
@@ -614,8 +614,12 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2f
 		    fsbtodb(fs, ext2_cg_location(fs, i)),
 		    fs->e2fs_bsize, NOCRED, &bp);
 		if (error) {
-			free(fs->e2fs_contigdirs, M_EXT2MNT);
-			free(fs->e2fs_gd, M_EXT2MNT);
+			/*
+			 * fs->e2fs_gd and fs->e2fs_contigdirs
+			 * will be freed later by the caller,
+			 * because this function could be called from
+			 * MNT_UPDATE path.
+			 */
 			brelse(bp);
 			return (error);
 		}