diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2026-05-08 13:03:49 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2026-05-20 19:37:14 +0000 |
| commit | dab07b77a683ef7fd3eb4d2ca8a99e2f3ed785d9 (patch) | |
| tree | 70d5db9de74632f39a337bcff73c796f719df252 /sys/dev/netmap/netmap_mem2.h | |
| parent | 8eb0bbbd2e4681dd6dc4b8d0e894438d6d4deedb (diff) | |
procdesc: Make sure to drain selinfo sleepers in procdesc_free()
Otherwise they are left on a freed list after procdesc_free() is called.
This can be exploited to elevate privileges.
Remove the PDF_SELECTED micro-optimization. doselwakeup() is a no-op if
no one ever called selrecord() on the file description, so I see no
reason to complicate the code to avoid the call.
Add some regression tests.
Approved by: so
Security: FreeBSD-SA-26:19.file
Security: CVE-2026-45251
Reported by: 75Acol, Lexpl0it, fcgboy, and robinzeng2015
Reviewed by: kib, oshogbo
Fixes: cfb5f7686588 ("Add experimental support for process descriptors")
Differential Revision: https://reviews.freebsd.org/D56887
Diffstat (limited to 'sys/dev/netmap/netmap_mem2.h')
0 files changed, 0 insertions, 0 deletions