From owner-svn-src-all@FreeBSD.ORG Tue May 22 19:43:21 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 60EFF1065672; Tue, 22 May 2012 19:43:21 +0000 (UTC) (envelope-from trasz@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 4CABE8FC0A; Tue, 22 May 2012 19:43:21 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q4MJhLvq023642; Tue, 22 May 2012 19:43:21 GMT (envelope-from trasz@svn.freebsd.org) Received: (from trasz@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q4MJhLDV023640; Tue, 22 May 2012 19:43:21 GMT (envelope-from trasz@svn.freebsd.org) Message-Id: <201205221943.q4MJhLDV023640@svn.freebsd.org> From: Edward Tomasz Napierala Date: Tue, 22 May 2012 19:43:21 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r235803 - head/sys/kern X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 May 2012 19:43:21 -0000 Author: trasz Date: Tue May 22 19:43:20 2012 New Revision: 235803 URL: http://svn.freebsd.org/changeset/base/235803 Log: Fix use-after-free in kern_jail_set() triggered e.g. by attempts to clear "persist" flag from empty persistent jail, like this: jail -c persist=1 jail -n 1 -m persist=0 Submitted by: Mateusz Guzik MFC after: 2 weeks Modified: head/sys/kern/kern_jail.c Modified: head/sys/kern/kern_jail.c ============================================================================== --- head/sys/kern/kern_jail.c Tue May 22 19:40:54 2012 (r235802) +++ head/sys/kern/kern_jail.c Tue May 22 19:43:20 2012 (r235803) @@ -1811,6 +1811,16 @@ kern_jail_set(struct thread *td, struct } } +#ifdef RACCT + if (!created) { + sx_sunlock(&allprison_lock); + prison_racct_modify(pr); + sx_slock(&allprison_lock); + } +#endif + + td->td_retval[0] = pr->pr_id; + /* * Now that it is all there, drop the temporary reference from existing * prisons. Or add a reference to newly created persistent prisons @@ -1832,12 +1842,6 @@ kern_jail_set(struct thread *td, struct sx_sunlock(&allprison_lock); } -#ifdef RACCT - if (!created) - prison_racct_modify(pr); -#endif - - td->td_retval[0] = pr->pr_id; goto done_errmsg; done_deref_locked: