Project

General

Profile

Actions

Bug #14132

open

possible use-after-free in be_do_copy_grub_cap()

Added by Dan McDonald 8 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Difficulty:
Medium
Tags:
Gerrit CR:

Description

Once in a rare while our SmartOS Jenkins builds will croak with:

/root/data/jenkins/workspace/smartos-master-default/projects/illumos/usr/src/tools/proto/root_i386-nd/opt/onbld/bin/i386/smatch: ../common/be_activate.c:1179 be_do_copy_grub_cap() warn: passing freed memory 'tmp_mntpnt'

Given we aren't using GRUB much, I'm not surprised we haven't seen this in the field.

A quick inspection of the aforementioned function shows that at or after line 1107 of be_activate.c, there are uses of "zhp" that follow a ZFS_CLOSE(), and furthermore, at line 1111 indeed tmp_mntpoint is freed, but it will be freed again(?) in the done: label section.

Someone more familiar with this code should check it. We do not see smatch complain about this save perhaps one in 20 builds, suggesting that there may be a smatch bug too?!

No data to display

Actions

Also available in: Atom PDF