From 84375c75df788b5ed47e480c541b53ee52482259 Mon Sep 17 00:00:00 2001 From: Xuqing Yang Date: Sat, 1 Aug 2026 01:01:31 +0800 Subject: [PATCH] s4:ntvfs:posix_eadb: avoid use-after-free on xattr list update failure In push_xattr_blob_tdb_raw(), mem_ctx owns the key used by tdb_chainunlock(). If posix_eadb_add_list() fails after the TDB chain has been locked, freeing mem_ctx before jumping to done leaves tkey dangling. The cleanup path then uses the freed key and frees mem_ctx again. Keep mem_ctx alive until the chain is unlocked, and free it only once. BUG: https://bugzilla.samba.org/show_bug.cgi?id=16217 Signed-off-by: Xuqing Yang Reviewed-by: Douglas Bagnall Reviewed-by: Noel Power Reviewed-by: Anoop C S Autobuild-User(master): Anoop C S Autobuild-Date(master): Mon Aug 10 18:08:01 UTC 2026 on atb-devel-224 (cherry picked from commit e595f37ccfec93f54d39140785643197ed09a9a4) --- source4/ntvfs/posix/posix_eadb.c | 1 - 1 file changed, 1 deletion(-) diff --git a/source4/ntvfs/posix/posix_eadb.c b/source4/ntvfs/posix/posix_eadb.c index 2d181fd42a4..60554e11fd5 100644 --- a/source4/ntvfs/posix/posix_eadb.c +++ b/source4/ntvfs/posix/posix_eadb.c @@ -181,7 +181,6 @@ NTSTATUS push_xattr_blob_tdb_raw(struct tdb_wrap *ea_tdb, status = posix_eadb_add_list(ea_tdb,mem_ctx, attr_name, fname, fd); if (!NT_STATUS_IS_OK(status)) { - talloc_free(mem_ctx); goto done; } -- 2.55.0