Page MenuHomeFreeBSD
Differential D28570

usr.sbin/makefs: fix use-after-free in read_mtree_keywords()
ClosedPublic
Actions

Authored by arichardson on Feb 10 2021, 12:07 PM.
Tags
None
Referenced Files
F106116520: D28570.diff
Wed, Dec 25, 4:15 PM
Unknown Object (File)
Wed, Dec 4, 10:36 AM
Unknown Object (File)
Wed, Dec 4, 2:37 AM
Unknown Object (File)
Mon, Dec 2, 4:38 PM
Unknown Object (File)
Nov 25 2024, 5:34 PM
Unknown Object (File)
Nov 25 2024, 1:05 AM
Unknown Object (File)
Nov 21 2024, 5:09 PM
Unknown Object (File)
Nov 21 2024, 3:27 PM
View All 80 Files
Subscribers
imp

Details

Reviewers
emaste
Commits
rG12ad8bdb34aa: usr.sbin/makefs: fix use-after-free in read_mtree_keywords()
Summary

The st variable is used as a shortcut for &node->inode->st, but in one
branch just before the exit we update node->inode without changing st.

Not sure which of the two approaches is preferable

Reported by: AddressSanitizer

Test Plan

ASan no longer complains.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

arichardson created this revision.Feb 10 2021, 12:07 PM
Herald added a subscriber: imp. · View Herald TranscriptFeb 10 2021, 12:07 PM
arichardson requested review of this revision.Feb 10 2021, 12:07 PM
Harbormaster completed remote builds in B36858: Diff 83635.Feb 10 2021, 12:07 PM
emaste added inline comments.Feb 10 2021, 2:59 PM
usr.sbin/makefs/mtree.c
786–787

I think I like this one slightly better

emaste accepted this revision.Feb 10 2021, 3:07 PM

LGTM. I'd probably not use "avoid UAF" in the comment though, we are resetting st because it has been invalidated by freeing node->inode

This revision is now accepted and ready to land.Feb 10 2021, 3:07 PM
arichardson updated this revision to Diff 83638.Feb 10 2021, 3:12 PM

Update comment and use first approach

This revision now requires review to proceed.Feb 10 2021, 3:12 PM
Harbormaster completed remote builds in B36860: Diff 83638.Feb 10 2021, 3:12 PM
arichardson marked an inline comment as done.Feb 10 2021, 3:12 PM
emaste accepted this revision.Feb 10 2021, 3:13 PM
This revision is now accepted and ready to land.Feb 10 2021, 3:13 PM
Closed by commit rG12ad8bdb34aa: usr.sbin/makefs: fix use-after-free in read_mtree_keywords() (authored by arichardson). · Explain WhyFeb 10 2021, 3:25 PM
This revision was automatically updated to reflect the committed changes.
arichardson added a commit: rG12ad8bdb34aa: usr.sbin/makefs: fix use-after-free in read_mtree_keywords().

Revision Contents
Changeset List

PathSize
usr.sbin/
makefs/
2 lines

Diff 83640

View Options

usr.sbin/makefs/mtree.c

Loading...