On Sat, May 07, 2016 at 11:59:09AM +0000, Maxime Villard wrote:
> Modified Files:
> src/sys/ufs/ffs: ffs_subr.c
>
> Log Message:
> uaf
: - if ((*bpp)->b_blkno >= 0 && (error = fscow_run(*bpp, false)) != 0)
: + if ((*bpp)->b_blkno >= 0 && (error = fscow_run(*bpp, false)) != 0) {
: brelse(*bpp, BC_INVAL);
: + *bpp = NULL;
: + }
If this makes any difference it means that the caller (of ffs_getblk)
is using the returned buffer even if the function fails, which is
wrong.
Please don't commit changes that mask bugs elsewhere... but in any
case please provide more information about what "uaf" you found and
where it really happens, so it can be fixed properly.