From 8ff81b8f87ded152f5f0cd593e4d541aac0a231e Mon Sep 17 00:00:00 2001 From: Matheus Date: Wed, 1 May 2024 22:19:09 -0300 Subject: [PATCH] futex: fix use after free --- kernel-src/sys/syscalls/futex.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel-src/sys/syscalls/futex.c b/kernel-src/sys/syscalls/futex.c index 9ec1f1a1..65e10122 100644 --- a/kernel-src/sys/syscalls/futex.c +++ b/kernel-src/sys/syscalls/futex.c @@ -79,6 +79,7 @@ syscallret_t syscall_futex(context_t *, uint32_t *futexp, int op, uint32_t value uint32_t *physical = vmm_getphysical(futexp); futex_t *futex = getfutex(physical); + bool doleave = true; switch (op) { case FUTEX_WAKE: @@ -145,6 +146,7 @@ syscallret_t syscall_futex(context_t *, uint32_t *futexp, int op, uint32_t value // clean up if needed if (futex->waiting == 0) { + doleave = false; free(futex); removefutex(physical); } @@ -157,7 +159,9 @@ syscallret_t syscall_futex(context_t *, uint32_t *futexp, int op, uint32_t value ret.errno = ENOSYS; } - poll_leave(&desc); + if (doleave) + poll_leave(&desc); + poll_destroydesc(&desc); MUTEX_RELEASE(&futexmutex);