[Bug 296578] loader use after free in UFS implementation

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296578

            Bug ID: 296578
           Summary: loader use after free in UFS implementation
           Product: Base System
           Version: 15.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: [email protected]
          Reporter: [email protected]

When a file on a UFS filesystem is being opened, a decision is made in
ufs_open() on whether to give the file a private copy of the superblock or a
pointer to a shared copy. In ufs_close() an attempt is made to guess what
decision was made in ufs_open(). However, in at least one situation (described
below) ufs_close() guesses wrong and deallocates the shared copy while an
opened file has a pointer to it. Further use of that opened file results in
use-after-free.

The specific situation that demonstrates the problem is as follows:
  1) Start the machine
  2) When the loader menu appears, escape to loader prompt
  3) Execute the command "map-vdisk /filesystem.img"
      This is expected to create a new virtual device named "vdisk0:". The file
/filesystem.img must reside on a UFS filesystem. The file itself should contain
a valid filesystem whose type is supported by the loader (e.g. UFS).
  4) Execute the command "set currdev=vdisk0:"
  5) Execute the command "ls /"

The "ls" command is expected to complete successfully but it doesn't. A hang
may be observed or some unexpected error message.

-- 
You are receiving this mail because:
You are the assignee for the bug.