Module Name: src
Committed By: christos
Date: Sat Jan 11 16:31:20 UTC 2014
Modified Files:
src/sys/kern: kern_verifiedexec.c
Log Message:
Reorder code to avoid use-after-free on error. From Maxime Villard
To generate a diff of this commit:
cvs rdiff -u -r1.131 -r1.132 src/sys/kern/kern_verifiedexec.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/kern_verifiedexec.c
diff -u src/sys/kern/kern_verifiedexec.c:1.131 src/sys/kern/kern_verifiedexec.c:1.132
--- src/sys/kern/kern_verifiedexec.c:1.131 Wed Nov 27 12:24:44 2013
+++ src/sys/kern/kern_verifiedexec.c Sat Jan 11 11:31:20 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_verifiedexec.c,v 1.131 2013/11/27 17:24:44 christos Exp $ */
+/* $NetBSD: kern_verifiedexec.c,v 1.132 2014/01/11 16:31:20 christos Exp $ */
/*-
* Copyright (c) 2005, 2006 Elad Efrat <e...@netbsd.org>
@@ -29,7 +29,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.131 2013/11/27 17:24:44 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.132 2014/01/11 16:31:20 christos Exp $");
#include "opt_veriexec.h"
@@ -1309,18 +1309,6 @@ veriexec_file_add(struct lwp *l, prop_di
vfe->npages = 0;
vfe->last_page_size = 0;
- vte = veriexec_table_lookup(vp->v_mount);
- if (vte == NULL)
- vte = veriexec_table_add(l, vp->v_mount);
-
- /* XXX if we bail below this, we might want to gc newly created vtes. */
-
- error = fileassoc_add(vp, veriexec_hook, vfe);
- if (error)
- goto unlock_out;
-
- vte->vte_count++;
-
if (prop_bool_true(prop_dictionary_get(dict, "eval-on-load")) ||
(vfe->type & VERIEXEC_UNTRUSTED)) {
u_char *digest;
@@ -1342,6 +1330,18 @@ veriexec_file_add(struct lwp *l, prop_di
kmem_free(digest, vfe->ops->hash_len);
}
+ vte = veriexec_table_lookup(vp->v_mount);
+ if (vte == NULL)
+ vte = veriexec_table_add(l, vp->v_mount);
+
+ /* XXX if we bail below this, we might want to gc newly created vtes. */
+
+ error = fileassoc_add(vp, veriexec_hook, vfe);
+ if (error)
+ goto unlock_out;
+
+ vte->vte_count++;
+
veriexec_file_report(NULL, "New entry.", file, NULL, REPORT_DEBUG);
veriexec_bypass = 0;
