Re: [9fans] Kernel crash bug

[cinap_lenrek@gmx.de]

[-- Attachment #1: Type: text/plain, Size: 392 bytes --]

maybe the kernel should use something like this to validate pointers
to null terminated strings?

(this assumes that validaddr for a byte will also be valid for the whole page)

void
validstraddr(char *p)
{
	char *x;

	for(;;){
		validaddr((ulong)p, 1, 0);
		x = (char*)(((ulong)p & ~(BY2PG-1))+BY2PG);
		for(; p < x; p++){
			if(*p == 0)
				return;
		}
	}
}

--
cinap

[-- Attachment #2: Type: message/rfc822, Size: 3019 bytes --]

From: Elizabeth Jones <elly1@andrew.cmu.edu>
To: 9fans@9fans.net
Subject: [9fans] Kernel crash bug
Date: Sat, 1 Aug 2009 17:01:26 -0400 (EDT)
Message-ID: <Pine.LNX.4.64-044.0908011700100.6538@unix10.andrew.cmu.edu>

There exist crash bugs in some of the system call handlers to do with
string validation; sometimes, only the first byte of an argument string is
validated. The following program reliably causes a kernel panic for me:

#include <u.h>
#include <libc.h>

#define SEGBASE (char*)0x40000000
#define SEGSIZE 4096

int main() {
     segattach(0, "shared", SEGBASE, SEGSIZE);
     *(char*)(SEGBASE + SEGSIZE - 1) = 'a';
     exec((char*)SEGBASE + SEGSIZE - 1, nil);
     return 0;
}

-- Elly