From 274236ed084a259a0e8a11df1afebd2f2f1fb097 Mon Sep 17 00:00:00 2001
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Tue, 6 Oct 2026 11:22:21 +0300
Subject: [PATCH] rtld.c: avoid double-free on dso load failure in
 do_load_object()

The obj->path is assigned directly from the path argument, and
load_object() frees the path on do_load_object() failure.  Do not free
it in obj_free() on the error path.

Reviewed by:	markj
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D60402
---
 libexec/rtld-elf/rtld.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c
index 850e017a404d..048cc473305a 100644
--- a/libexec/rtld-elf/rtld.c
+++ b/libexec/rtld-elf/rtld.c
@@ -3027,6 +3027,7 @@ do_load_object(int fd, const char *name, char *path, struct stat *sbp,
 
 errp:
 	munmap(obj->mapbase, obj->mapsize);
+	obj->path = NULL;	/* obj->path is owned and freed by caller */
 	obj_free(obj);
 	return (NULL);
 }