bugThe GNU Hurd - Bugs: bug #49056, sending mach_port_kernel_object to...

 
 

bug #49056: sending mach_port_kernel_object to non-task object crashes mach

Submitter:  Kalle Olavi Niemitalo <kon>
Submitted:  Sun 11 Sep 2016 08:01:37 AM UTC
   
 
Category:  GNU Mach Severity:  3 - Normal
Priority:  5 - Normal Item Group:  None
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Closed Reproducibility:  Every Time
Size (loc):  None Planned Release:  None
Effort:  0.00
Wiki-like text discussion box: 


* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 11 Sep 2016 03:27:04 PM UTC, comment #2: 

If I understand https://www.gnu.org/prep/maintain/maintain.html#Legally-Significant correctly, the FSF does not want more than around 15 lines of code without a copyright assignment.  I hope I can spend the remaining number of lines on something more widely useful than a simple fix like this.

Kalle Olavi Niemitalo <kon>
Sun 11 Sep 2016 10:15:14 AM UTC, comment #1: 

Thanks for the report, fixed in 25d5ceed.

I must ask though, in the time it has taken you to file this report and write a reproducer, you could have fixed this by your self like 25 times in a row.  Why didn't you?

Justus Winter <teythoon>
Group Member
Sun 11 Sep 2016 08:01:37 AM UTC, original submission:  

If a process sends the mach_port_kernel_object request to a kernel object that is not a task (can be a thread instead), then an assertion fails in debug build of GNU Mach, and it drops to the kernel debugger.  In a non-debug build, I think it would cause a null pointer dereference instead.

In <mach_debug/mach_debug.defs>, the first parameter of mach_port_kernel_object is an ipc_space_t.  In <mach/mach_types.defs>, the intran of ipc_space_t is 'ipc_space_t convert_port_to_space(mach_port_t)', which is defined in kern/ipc_tt.c and returns IS_NULL if the port does not refer to a task.  The mach_port_kernel_object function (defined in ipc/mach_debug.c) then receives IS_NULL in its 'ipc_space_t space' parameter and calls (via the ipc_right_lookup_read macro) the ipc_right_lookup_write function (defined in ipc/ipc_right.c), which contains the assertion 'assert(space != IS_NULL);'.

To fix this, mach_port_kernel_object needs to check for 'space == IS_NULL' itself and return KERN_INVALID_TASK, like mach_port_dnrequest_info already does.

To reproduce the bug, boot up a debug build of GNU Mach, put the attached lookup_kernel_object.c to some directory, and run:


mig /usr/include/mach_debug/mach_debug.defs
gcc lookup_kernel_object.c mach_debugUser.c
./a.out


In the console, the assertion failure then appears like this:


Assertion `space != IS_NULL' failed in file "../ipc/ipc_right.c", line 74
Debugger invoked: assertion failure
Kernel Breakpoint trap, eip 0x810200f4
Stopped at  Debugger+0x13:      int     $3
Debugger(810d9140,810d8ed5,810d8ec2,4a,c2c2cffc)+0x13
Assert(810d8ed5,810d8ec2,4a,80000001,0)+0x25
ipc_right_lookup_write(0,43,bbd01ee4,c2c2b000)+0x95
mach_port_kernel_object(0,43,c2c2b034,c2c2b03c,b9954948)+0x18
_Xmach_port_kernel_object(b8e8a010,c2c2b010,bbd01f60,c,43)+0x4a
ipc_kobject_server(b8e8a000,43,0,0)+0x92
mach_msg_trap(102dd30,3,20,30,73)+0x7c4
db>


Kalle Olavi Niemitalo <kon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #38475:  lookup_kernel_object.c added by kon (539B - text/x-csrc - repro)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by teythoon (Posted a comment)
  • -email is unavailable- added by kon (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-09-11 teythoon Open/ClosedOpen Closed
    2016-09-11 kon Attached File- Added lookup_kernel_object.c, #38475

    Back to the top

    Powered by Savane 3.12