s4:ntvfs:posix_eadb: avoid use-after-free on xattr list update failure

In push_xattr_blob_tdb_raw(), mem_ctx owns the key used by
tdb_chainunlock(). If posix_eadb_add_list() fails after the TDB chain
has been locked, freeing mem_ctx before jumping to done leaves tkey
dangling. The cleanup path then uses the freed key and frees mem_ctx
again.

Keep mem_ctx alive until the chain is unlocked, and free it only once.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16217

Signed-off-by: Xuqing Yang <rigelyoung@icloud.com>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Noel Power <npower@samba.org>
Reviewed-by: Anoop C S <anoopcs@samba.org>
Autobuild-User(master): Anoop C S <anoopcs@samba.org>
Autobuild-Date(master): Mon Aug 10 18:08:01 UTC 2026 on atb-devel-224

diff --git a/source4/ntvfs/posix/posix_eadb.c b/source4/ntvfs/posix/posix_eadb.c
index 2d181fd42a432ad69a04280931f74a93a3fe76bb..60554e11fd5f486b12b443152631fe5994aa257b 100644 (file)
--- a/source4/ntvfs/posix/posix_eadb.c
+++ b/source4/ntvfs/posix/posix_eadb.c
@@ -181,7 +181,6 @@ NTSTATUS push_xattr_blob_tdb_raw(struct tdb_wrap *ea_tdb,
 
        status = posix_eadb_add_list(ea_tdb,mem_ctx, attr_name, fname, fd);
        if (!NT_STATUS_IS_OK(status)) {
-               talloc_free(mem_ctx);
                goto done;
        }