Page MenuHomeFreeBSD

sound: Drain buffer selinfo in sndbuf_free()
ClosedPublic

Authored by christos on Mar 28 2024, 5:15 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Oct 7, 9:54 PM
Unknown Object (File)
Sun, Sep 28, 3:18 AM
Unknown Object (File)
Mon, Sep 22, 11:01 PM
Unknown Object (File)
Mon, Sep 22, 2:13 PM
Unknown Object (File)
Sat, Sep 20, 6:35 PM
Unknown Object (File)
Sep 10 2025, 2:11 PM
Unknown Object (File)
Aug 4 2025, 10:51 AM
Unknown Object (File)
Aug 3 2025, 9:33 PM
Subscribers
None

Details

Summary

Prevent a use-after-free in kern_poll() by making sure the buffer's
selinfo is drained.

Reported by: KASAN
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

christos created this revision.
christos retitled this revision from sound: drain buffer selinfo during sndbuf_free() to sound: Drain buffer selinfo in sndbuf_free().Mar 28 2024, 5:18 AM

In the commit message, you should note that this is only required with async detach.

This revision is now accepted and ready to land.Mar 29 2024, 2:43 PM