Page MenuHomeFreeBSD

usr.sbin/makefs: fix use-after-free in read_mtree_keywords()
ClosedPublic

Authored by arichardson on Feb 10 2021, 12:07 PM.
Tags
None
Referenced Files
F102357826: D28570.id.diff
Mon, Nov 11, 4:26 AM
Unknown Object (File)
Sun, Nov 10, 7:04 AM
Unknown Object (File)
Sat, Oct 19, 6:33 AM
Unknown Object (File)
Sat, Oct 19, 6:33 AM
Unknown Object (File)
Sat, Oct 19, 6:32 AM
Unknown Object (File)
Sat, Oct 19, 6:32 AM
Unknown Object (File)
Sat, Oct 19, 6:11 AM
Unknown Object (File)
Tue, Oct 15, 9:42 AM
Subscribers

Details

Summary

The st variable is used as a shortcut for &node->inode->st, but in one
branch just before the exit we update node->inode without changing st.

Not sure which of the two approaches is preferable

Reported by: AddressSanitizer

Test Plan

ASan no longer complains.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

usr.sbin/makefs/mtree.c
786–787

I think I like this one slightly better

LGTM. I'd probably not use "avoid UAF" in the comment though, we are resetting st because it has been invalidated by freeing node->inode

This revision is now accepted and ready to land.Feb 10 2021, 3:07 PM

Update comment and use first approach

This revision now requires review to proceed.Feb 10 2021, 3:12 PM
This revision is now accepted and ready to land.Feb 10 2021, 3:13 PM