Module Name: src
Committed By: msaitoh
Date: Tue Mar 18 09:21:30 UTC 2014
Modified Files:
src/sys/kern [netbsd-6]: kern_verifiedexec.c
Log Message:
Pull up following revision(s) (requested by maxv in ticket #1034):
sys/kern/kern_verifiedexec.c: revision 1.132
Reorder code to avoid use-after-free on error. From Maxime Villard
To generate a diff of this commit:
cvs rdiff -u -r1.128 -r1.128.4.1 src/sys/kern/kern_verifiedexec.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/kern/kern_verifiedexec.c
diff -u src/sys/kern/kern_verifiedexec.c:1.128 src/sys/kern/kern_verifiedexec.c:1.128.4.1
--- src/sys/kern/kern_verifiedexec.c:1.128 Sun Nov 20 10:32:33 2011
+++ src/sys/kern/kern_verifiedexec.c Tue Mar 18 09:21:30 2014
@@ -1,4 +1,4 @@
-/* $NetBSD: kern_verifiedexec.c,v 1.128 2011/11/20 10:32:33 hannken Exp $ */
+/* $NetBSD: kern_verifiedexec.c,v 1.128.4.1 2014/03/18 09:21:30 msaitoh Exp $ */
/*-
* Copyright (c) 2005, 2006 Elad Efrat <e...@netbsd.org>
@@ -29,7 +29,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.128 2011/11/20 10:32:33 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_verifiedexec.c,v 1.128.4.1 2014/03/18 09:21:30 msaitoh Exp $");
#include "opt_veriexec.h"
@@ -1281,18 +1281,6 @@ veriexec_file_add(struct lwp *l, prop_di
vfe->npages = 0;
vfe->last_page_size = 0;
- vte = veriexec_table_lookup(vp->v_mount);
- if (vte == NULL)
- vte = veriexec_table_add(l, vp->v_mount);
-
- /* XXX if we bail below this, we might want to gc newly created vtes. */
-
- error = fileassoc_add(vp, veriexec_hook, vfe);
- if (error)
- goto unlock_out;
-
- vte->vte_count++;
-
if (prop_bool_true(prop_dictionary_get(dict, "eval-on-load")) ||
(vfe->type & VERIEXEC_UNTRUSTED)) {
u_char *digest;
@@ -1314,6 +1302,18 @@ veriexec_file_add(struct lwp *l, prop_di
kmem_free(digest, vfe->ops->hash_len);
}
+ vte = veriexec_table_lookup(vp->v_mount);
+ if (vte == NULL)
+ vte = veriexec_table_add(l, vp->v_mount);
+
+ /* XXX if we bail below this, we might want to gc newly created vtes. */
+
+ error = fileassoc_add(vp, veriexec_hook, vfe);
+ if (error)
+ goto unlock_out;
+
+ vte->vte_count++;
+
veriexec_file_report(NULL, "New entry.", file, NULL, REPORT_DEBUG);
veriexec_bypass = 0;
