[Bug 296578] loader use after free in UFS implementation

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296578

--- Comment #3 from Jordan Gordeev <[email protected]> ---
(In reply to Toomas Soome from comment #2)

> You can verify if keeping currdev as is and accessing vdisk0: directly (example: ls vdisk0:) will work as expected.

If the 'currdev' variable is left unchanged, there are two cases:

  Case 1. The vdisk contains only a UFS filesystem, without a partition table.
In this case, the command "ls vdisk0:" leads to an error message:
    open 'vdiskø:/' failed: no such file or directory

This is not related to vdisks as it can also happen with normal disks ("disk0",
"disk1", etc.). This is a separate problem that I will file as a separate bug.

  Case 2. The vdisk contains a partition table with a single partition. The
partition contains a UFS filesystem. In this case the command "ls vdisk0p1:"
completes successfully and produces the expected result.

If I remove this code from ufs_close():
        if (mnt == NULL && fp->f_fs != NULL) {
                free(fp->f_fs->fs_csp);
                free(fp->f_fs->fs_si);
                free(fp->f_fs);
        }
then after "set currdev=vdisk0p1:", the command "ls /" completes successfully
and produces the expected result.

-- 
You are receiving this mail because:
You are the assignee for the bug.