mirrors/Astral
1
0
Fork 0
mirror of https://github.com/Mathewnd/Astral.git synced 2026-10-31 06:28:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

futex: fix use after free

Browse Source
This commit is contained in:
Matheus
2024-05-01 22:19:09 -03:00
parent 0280c89923
commit 8ff81b8f87
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel-src/sys/syscalls/futex.c
+5 -1
View File
@@ -79,6 +79,7 @@ syscallret_t syscall_futex(context_t *, uint32_t *futexp, int op, uint32_t value
uint32_t *physical = vmm_getphysical(futexp); uint32_t *physical = vmm_getphysical(futexp);
futex_t *futex = getfutex(physical); futex_t *futex = getfutex(physical);
bool doleave = true;
switch (op) { switch (op) {
case FUTEX_WAKE: case FUTEX_WAKE:
@@ -145,6 +146,7 @@ syscallret_t syscall_futex(context_t *, uint32_t *futexp, int op, uint32_t value
// clean up if needed // clean up if needed
if (futex->waiting == 0) { if (futex->waiting == 0) {
doleave = false;
free(futex); free(futex);
removefutex(physical); removefutex(physical);
} }
@@ -157,7 +159,9 @@ syscallret_t syscall_futex(context_t *, uint32_t *futexp, int op, uint32_t value
ret.errno = ENOSYS; ret.errno = ENOSYS;
} }
poll_leave(&desc); if (doleave)
poll_leave(&desc);
poll_destroydesc(&desc); poll_destroydesc(&desc);
MUTEX_RELEASE(&futexmutex); MUTEX_RELEASE(&futexmutex);