Opened 2 years ago

Last modified 5 weeks ago

#13131 new bug

FS shell: VFS use after free error

Reported by: jscipione Owned by: jscipione
Priority: normal Milestone: R1
Component: Build System Version: R1/Development
Keywords: Cc:
Blocked By: Blocking:
Has a Patch: yes Platform: All

Description

In the VFS subsystem CID is reporting that we have several cases where we are using a pointer after freeing it. See attached CID report for more details I believe this is caused by vnode_path_to_vnode() decrementing the ref_count of the vnode freeing it before it was expected.

Attachments (2)

CID 702320 and 1397511 USE_AFTER_FREE.txt (3.5 KB) - added by jscipione 2 years ago.
CID 702320 and 1397511 USE_AFTER_FREE
0001-VFS-Fix-CID-702320-1397511-USE_AFTER_FREE.patch (2.1 KB) - added by jscipione 2 years ago.
Patch which increments vnode ref_count before calling vnode_path_to_vnode()

Download all attachments as: .zip

Change History (7)

Changed 2 years ago by jscipione

CID 702320 and 1397511 USE_AFTER_FREE

Changed 2 years ago by jscipione

Patch which increments vnode ref_count before calling vnode_path_to_vnode()

comment:1 Changed 2 years ago by jscipione

Has a Patch: set

comment:2 Changed 2 years ago by jscipione

Perhaps a better way to fix this would be to rewrite vnode_path_to_vnode() to not decrement the ref_count of the passed in vnode anymore.

comment:3 Changed 2 years ago by bonefish

Component: System/KernelBuild System
Summary: VFS use after free errorFS shell: VFS use after free error

Please note that the code in question is a fork of an earlier version of the kernel code. Without having looked into the issues in question, an option other than to fix the bugs in this implementation could be to update the code to the current version (respectively port the changes since the last update).

comment:4 Changed 5 weeks ago by jscipione

Does hrev52646 have an effect on this ticket or does it at least reveal the real bug culprit? Asking because this bug has to do with the vfs subsystem and ref_count being wrong causing use after free errors.

comment:5 Changed 5 weeks ago by waddlesplash

Uh, neither; this ticket is about the VFS shell, which uses a copy of the VFS code and hasn't been touched in quite a while.

Note: See TracTickets for help on using tickets.