Bug #14132
openpossible use-after-free in be_do_copy_grub_cap()
0%
Description
Once in a rare while our SmartOS Jenkins builds will croak with:
/root/data/jenkins/workspace/smartos-master-default/projects/illumos/usr/src/tools/proto/root_i386-nd/opt/onbld/bin/i386/smatch: ../common/be_activate.c:1179 be_do_copy_grub_cap() warn: passing freed memory 'tmp_mntpnt'
Given we aren't using GRUB much, I'm not surprised we haven't seen this in the field.
A quick inspection of the aforementioned function shows that at or after line 1107 of be_activate.c, there are uses of "zhp" that follow a ZFS_CLOSE(), and furthermore, at line 1111 indeed tmp_mntpoint is freed, but it will be freed again(?) in the done: label section.
Someone more familiar with this code should check it. We do not see smatch complain about this save perhaps one in 20 builds, suggesting that there may be a smatch bug too?!
No data to display