Source-Changes-D archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: CVS commit: src/sys/ufs/ffs



On Sat, May 07, 2016 at 11:59:09AM +0000, Maxime Villard wrote:
 > Modified Files:
 > 	src/sys/ufs/ffs: ffs_subr.c
 > 
 > Log Message:
 > uaf

 : -       if ((*bpp)->b_blkno >= 0 && (error = fscow_run(*bpp, false)) != 0)
 : +       if ((*bpp)->b_blkno >= 0 && (error = fscow_run(*bpp, false)) != 0) {
 :                brelse(*bpp, BC_INVAL);
 : +               *bpp = NULL;
 : +       }

If this makes any difference it means that the caller (of ffs_getblk)
is using the returned buffer even if the function fails, which is
wrong.

Please don't commit changes that mask bugs elsewhere... but in any
case please provide more information about what "uaf" you found and
where it really happens, so it can be fixed properly.

-- 
David A. Holland
dholland%netbsd.org@localhost


Home | Main Index | Thread Index | Old Index