mirror of
https://github.com/opnsense/src.git
synced 2026-04-22 23:02:02 -04:00
Correct a reference counting bug in shmat(2). If vm_map_find(9)
failed, the reference count for the virtual memory object referenced by the specified shared memory segment would have been erroneously incremented. Reported by: Joost Pol <joost@pine.nl>
This commit is contained in:
parent
dec8868dcc
commit
b00a3c85da
1 changed files with 1 additions and 0 deletions
|
|
@ -378,6 +378,7 @@ kern_shmat(td, shmid, shmaddr, shmflg)
|
|||
rv = vm_map_find(&p->p_vmspace->vm_map, shm_handle->shm_object,
|
||||
0, &attach_va, size, (flags & MAP_FIXED)?0:1, prot, prot, 0);
|
||||
if (rv != KERN_SUCCESS) {
|
||||
vm_object_deallocate(shm_handle->shm_object);
|
||||
error = ENOMEM;
|
||||
goto done2;
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue