diff options
| author | Fedor Uporov <fsu@FreeBSD.org> | 2019-03-04 11:33:49 +0000 |
|---|---|---|
| committer | Fedor Uporov <fsu@FreeBSD.org> | 2019-03-04 11:33:49 +0000 |
| commit | 9441309ae0d55f28e64088a6b4efe2643d19b82b (patch) | |
| tree | aefe20826a79c665b739f84387f471137e16083f /sys/fs/ext2fs/ext2_vfsops.c | |
| parent | 3eed9f20d45b01acb19e68959e3baf35cda2727a (diff) | |
| download | src-9441309ae0d55f28e64088a6b4efe2643d19b82b.tar.gz src-9441309ae0d55f28e64088a6b4efe2643d19b82b.zip | |
Fix double free in case of mount error.
Reported by: Christopher Krah <krah@protonmail.com>
Reported as: FS-9-EXT3-2: Denial Of Service in nmount-5 (vm_fault_hold)
Reviewed by: pfg
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D19385
Notes
Notes:
svn path=/head/; revision=344757
Diffstat (limited to 'sys/fs/ext2fs/ext2_vfsops.c')
| -rw-r--r-- | sys/fs/ext2fs/ext2_vfsops.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/sys/fs/ext2fs/ext2_vfsops.c b/sys/fs/ext2fs/ext2_vfsops.c index a363a5641aed..34b58dcc579e 100644 --- a/sys/fs/ext2fs/ext2_vfsops.c +++ b/sys/fs/ext2fs/ext2_vfsops.c @@ -614,8 +614,12 @@ ext2_compute_sb_data(struct vnode *devvp, struct ext2fs *es, fsbtodb(fs, ext2_cg_location(fs, i)), fs->e2fs_bsize, NOCRED, &bp); if (error) { - free(fs->e2fs_contigdirs, M_EXT2MNT); - free(fs->e2fs_gd, M_EXT2MNT); + /* + * fs->e2fs_gd and fs->e2fs_contigdirs + * will be freed later by the caller, + * because this function could be called from + * MNT_UPDATE path. + */ brelse(bp); return (error); } |