bugThe GNU Hurd - Bugs: bug #49056, sending mach_port_kernel_object to...

 
 

bug #49056: sending mach_port_kernel_object to non-task object crashes mach

Submitted by:  Kalle Olavi Niemitalo <kon>
Submitted on:  Sun 11 Sep 2016 08:01:37 AM UTC  
 
Category: GNU MachSeverity: 3 - Normal
Priority: 5 - NormalItem Group: None
Status: NonePrivacy: Public
Assigned to: NoneOriginator Name: 
Open/Closed: ClosedReproducibility: Every Time
Size (loc): NonePlanned Release: None
Effort: 0.00
Wiki-like text discussion box: 

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 11 Sep 2016 03:27:04 PM UTC, comment #2:

If I understand https://www.gnu.org/prep/maintain/maintain.html#Legally-Significant correctly, the FSF does not want more than around 15 lines of code without a copyright assignment. I hope I can spend the remaining number of lines on something more widely useful than a simple fix like this.

Kalle Olavi Niemitalo <kon>
Sun 11 Sep 2016 10:15:14 AM UTC, comment #1:

Thanks for the report, fixed in 25d5ceed.

I must ask though, in the time it has taken you to file this report and write a reproducer, you could have fixed this by your self like 25 times in a row. Why didn't you?

Justus Winter <teythoon>
Project Member
Sun 11 Sep 2016 08:01:37 AM UTC, original submission:

If a process sends the mach_port_kernel_object request to a kernel object that is not a task (can be a thread instead), then an assertion fails in debug build of GNU Mach, and it drops to the kernel debugger. In a non-debug build, I think it would cause a null pointer dereference instead.

In <mach_debug/mach_debug.defs>, the first parameter of mach_port_kernel_object is an ipc_space_t. In <mach/mach_types.defs>, the intran of ipc_space_t is 'ipc_space_t convert_port_to_space(mach_port_t)', which is defined in kern/ipc_tt.c and returns IS_NULL if the port does not refer to a task. The mach_port_kernel_object function (defined in ipc/mach_debug.c) then receives IS_NULL in its 'ipc_space_t space' parameter and calls (via the ipc_right_lookup_read macro) the ipc_right_lookup_write function (defined in ipc/ipc_right.c), which contains the assertion 'assert(space != IS_NULL);'.

To fix this, mach_port_kernel_object needs to check for 'space == IS_NULL' itself and return KERN_INVALID_TASK, like mach_port_dnrequest_info already does.

To reproduce the bug, boot up a debug build of GNU Mach, put the attached lookup_kernel_object.c to some directory, and run:

In the console, the assertion failure then appears like this:

Kalle Olavi Niemitalo <kon>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #38475:  lookup_kernel_object.c added by kon (539B - text/x-csrc - repro)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by teythoon (Posted a comment)
  • -unavailable- added by kon (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 11 Sep 2016 10:15:14 AM UTCteythoonOpen/ClosedOpen=>Closed
    Sun 11 Sep 2016 08:01:37 AM UTCkonAttached File-=>Added lookup_kernel_object.c, #38475

    Back to the top


    Powered by Savane 3.1-cleanup1