tech-kern archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Brainy: UAF in iscsi_ioctl.c



On Sun, 20 Sep 2015, Roy Marples wrote:

On 2015-09-19 19:33, David Holland wrote:
On Sat, Sep 19, 2015 at 04:18:38PM +0200, Maxime Villard wrote:
 > Hi,
 > in sys/dev/iscsi/iscsi_ioctl.c:
 >
 > 1542		free(sess, M_DEVBUF);
 > 1543
 > 1544		DEB(1, ("Cleanup: session ended %d\n", sess->id));
 >
 > I guess inverting the two instructions fixes the bug.
 >
 > Found by Brainy.

Fixed, but you can commit ones like this yourself you know :-)

But then you would miss out on the Found by Brainy advertisements! ;)

Not really - Max can just put the "Found by Brainy" in his commit logs!



+------------------+--------------------------+-------------------------+
| Paul Goyette     | PGP Key fingerprint:     | E-mail addresses:       |
| (Retired)        | FA29 0E3B 35AF E8AE 6651 | paul at whooppee.com    |
| Kernel Developer | 0786 F758 55DE 53BA 7731 | pgoyette at netbsd.org  |
+------------------+--------------------------+-------------------------+


Home | Main Index | Thread Index | Old Index