MFC r343784:

Avoid leaking fp references when truncating SCM_RIGHTS control messages. Approved by: so Security: CVE-2019-5596
HardenedBSD · Feb 5, 2019 · 70e1efc · 70e1efc
1 parent 7ecad8e
commit 70e1efc
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
@@ -1831,8 +1831,10 @@ m_dispose_extcontrolm(struct mbuf *m)
 					fd = *fds++;
 					error = fget(td, fd,
 					    cap_rights_init(&rights), &fp);
-					if (error == 0)
+					if (error == 0) {
 						fdclose(td, fp, fd);
+						fdrop(fp, td);
+					}
 				}
 			}
 			clen -= datalen;