mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-05-21 02:22:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

Kernel: Fix Process use-after-free in Thread finalization

Browse source 
We leak a ref() onto every user process when constructing them,
either via Process::create_user_process(), or via Process::sys$fork().

This ref() is balanced by a corresponding unref() in
Thread::WaitBlockCondition::finalize().

Since kernel processes don't have a leaked ref() on them, this led to
an extra Process::unref() on kernel processes during finalization.
This happened during every boot, with the `init_stage2` process.

Found by turning off kfree() scrubbing. :^)
This commit is contained in:
Andreas Kling 2021-07-14 21:09:37 +02:00
parent 6211eb0f9a
commit 859e5741ff
Notes: sideshowbarker 2024-07-18 09:02:04 +09:00
3 changed files with 14 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

5
Kernel/Syscalls/fork.cpp
View file

@ -119,9 +119,10 @@ KResultOr<FlatPtr> Process::sys$fork(RegisterState& regs)
child_first_thread->set_state(Thread::State::Runnable);
auto child_pid = child->pid().value();
// We need to leak one reference so we don't destroy the Process,
// which will be dropped by Process::reap
// NOTE: All user processes have a leaked ref on them. It's balanced by Thread::WaitBlockCondition::finalize().
(void)child.leak_ref();
return child_pid;
}