Sun 11 Sep 2016 08:01:37 AM UTC, original submission:
If a process sends the mach_port_kernel_object request to a kernel object that is not a task (can be a thread instead), then an assertion fails in debug build of GNU Mach, and it drops to the kernel debugger. In a non-debug build, I think it would cause a null pointer dereference instead.
In <mach_debug/mach_debug.defs>, the first parameter of mach_port_kernel_object is an ipc_space_t. In <mach/mach_types.defs>, the intran of ipc_space_t is 'ipc_space_t convert_port_to_space(mach_port_t)', which is defined in kern/ipc_tt.c and returns IS_NULL if the port does not refer to a task. The mach_port_kernel_object function (defined in ipc/mach_debug.c) then receives IS_NULL in its 'ipc_space_t space' parameter and calls (via the ipc_right_lookup_read macro) the ipc_right_lookup_write function (defined in ipc/ipc_right.c), which contains the assertion 'assert(space != IS_NULL);'.
To fix this, mach_port_kernel_object needs to check for 'space == IS_NULL' itself and return KERN_INVALID_TASK, like mach_port_dnrequest_info already does.
To reproduce the bug, boot up a debug build of GNU Mach, put the attached lookup_kernel_object.c to some directory, and run:
In the console, the assertion failure then appears like this:
|