Attachment 19159 Details for Bug 16217 – patch from master for v4-24-test

[patch] patch from master for v4-24-test

v4.24.patch (text/plain), 1.51 KB, created by Anoop C S on 2026-08-11 05:08:48 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Anoop C S

Created: 2026-08-11 05:08:48 UTC

Size: 1.51 KB

patch

obsolete

>From e96c1fb24ff819a16b44397a91f1bfb09add322f Mon Sep 17 00:00:00 2001
>From: Xuqing Yang <rigelyoung@icloud.com>
>Date: Sat, 1 Aug 2026 01:01:31 +0800
>Subject: [PATCH] s4:ntvfs:posix_eadb: avoid use-after-free on xattr list
> update failure
>
>In push_xattr_blob_tdb_raw(), mem_ctx owns the key used by
>tdb_chainunlock(). If posix_eadb_add_list() fails after the TDB chain
>has been locked, freeing mem_ctx before jumping to done leaves tkey
>dangling. The cleanup path then uses the freed key and frees mem_ctx
>again.
>
>Keep mem_ctx alive until the chain is unlocked, and free it only once.
>
>BUG: https://bugzilla.samba.org/show_bug.cgi?id=16217
>
>Signed-off-by: Xuqing Yang <rigelyoung@icloud.com>
>Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
>Reviewed-by: Noel Power <npower@samba.org>
>Reviewed-by: Anoop C S <anoopcs@samba.org>
>
>Autobuild-User(master): Anoop C S <anoopcs@samba.org>
>Autobuild-Date(master): Mon Aug 10 18:08:01 UTC 2026 on atb-devel-224
>
>(cherry picked from commit e595f37ccfec93f54d39140785643197ed09a9a4)
>---
> source4/ntvfs/posix/posix_eadb.c | 1 -
> 1 file changed, 1 deletion(-)
>
>diff --git a/source4/ntvfs/posix/posix_eadb.c b/source4/ntvfs/posix/posix_eadb.c
>index 2d181fd42a4..60554e11fd5 100644
>--- a/source4/ntvfs/posix/posix_eadb.c
>+++ b/source4/ntvfs/posix/posix_eadb.c
>@@ -181,7 +181,6 @@ NTSTATUS push_xattr_blob_tdb_raw(struct tdb_wrap *ea_tdb,
> 
> 	status = posix_eadb_add_list(ea_tdb,mem_ctx, attr_name, fname, fd);
> 	if (!NT_STATUS_IS_OK(status)) {
>-		talloc_free(mem_ctx);
> 		goto done;
> 	}
> 
>-- 
>2.55.0
>

Flags:

dbagnall: review+

Actions: View

Attachments on bug 16217: 19159 | 19160