From: Xuqing Yang Date: Fri, 31 Jul 2026 17:01:31 +0000 (+0800) Subject: s4:ntvfs:posix_eadb: avoid use-after-free on xattr list update failure X-Git-Tag: samba-4.25.0rc1~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e595f37ccfec93f54d39140785643197ed09a9a4;p=thirdparty%2Fsamba.git s4:ntvfs:posix_eadb: avoid use-after-free on xattr list update failure In push_xattr_blob_tdb_raw(), mem_ctx owns the key used by tdb_chainunlock(). If posix_eadb_add_list() fails after the TDB chain has been locked, freeing mem_ctx before jumping to done leaves tkey dangling. The cleanup path then uses the freed key and frees mem_ctx again. Keep mem_ctx alive until the chain is unlocked, and free it only once. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16217 Signed-off-by: Xuqing Yang Reviewed-by: Douglas Bagnall Reviewed-by: Noel Power Reviewed-by: Anoop C S Autobuild-User(master): Anoop C S Autobuild-Date(master): Mon Aug 10 18:08:01 UTC 2026 on atb-devel-224 --- diff --git a/source4/ntvfs/posix/posix_eadb.c b/source4/ntvfs/posix/posix_eadb.c index 2d181fd42a4..60554e11fd5 100644 --- a/source4/ntvfs/posix/posix_eadb.c +++ b/source4/ntvfs/posix/posix_eadb.c @@ -181,7 +181,6 @@ NTSTATUS push_xattr_blob_tdb_raw(struct tdb_wrap *ea_tdb, status = posix_eadb_add_list(ea_tdb,mem_ctx, attr_name, fname, fd); if (!NT_STATUS_IS_OK(status)) { - talloc_free(mem_ctx); goto done; }