Andreas Kling 859e5741ff Kernel: Fix Process use-after-free in Thread finalization ...

We leak a ref() onto every user process when constructing them,
either via Process::create_user_process(), or via Process::sys$fork().

This ref() is balanced by a corresponding unref() in
Thread::WaitBlockCondition::finalize().

Since kernel processes don't have a leaked ref() on them, this led to
an extra Process::unref() on kernel processes during finalization.
This happened during every boot, with the `init_stage2` process.

Found by turning off kfree() scrubbing. :^)

2021-07-14 22:36:29 +02:00

26 KiB

Raw Blame History

View Raw