HomeFreeBSD

file: Avoid a read-after-free of fd tables in sysctl handlers

Description

file: Avoid a read-after-free of fd tables in sysctl handlers

Some loops access the fd table of a different process, and drop the
filedesc lock while iterating, so they check the table's refcount.
However, we access the table before the first iteration, in order to get
the number of table entries, and this access can be a use-after-free.

Fix the problem by checking the refcount before we start iterating.

Reported by: pho
Reviewed by: mjg
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D34575

Details

Provenance
markjAuthored on Mar 17 2022, 4:54 PM
Reviewer
mjg
Differential Revision
D34575: file: Avoid a read-after-free of fd tables in sysctl handlers
Parents
rG7846554819d3: rc.d: Chmod +x all the scripts for consistency
Branches
Unknown
Tags
Unknown