[9fans] devproc procctl close bug

[9fans] devproc procctl close bug

[cinap_lenrek]

theres a bug in devproc again.

the fd is not bounds checked for the "close fd"
procctl command and the "closefiles" command misses
the last fd as it iterates from:

fd=0 to maxfd-1 and not to maxfd in procctlclosefiles()

static void
procctlcloseone(Proc *p, Fgrp *f, int fd)
{
	Chan *c;

	c = f->fd[fd];	// <-- not checked
	if(c == nil)
		return;
	f->fd[fd] = nil;
	unlock(f);
	qunlock(&p->debug);
	cclose(c);
	qlock(&p->debug);
	lock(f);
}

procctlclosefiles(Proc *p, int all, int fd)
{
	int i;
	Fgrp *f;

	f = p->fgrp;
	if(f == nil)
		error(Eprocdied);

	lock(f);
	f->ref++;
	if(all)
		for(i = 0; i < f->maxfd; i++)	// <-- wrong
			procctlcloseone(p, f, i);
	else
		procctlcloseone(p, f, fd);
	unlock(f);
	closefgrp(f);
}

...
	case CMclose:
		procctlclosefiles(p, 0, atoi(cb->f[1]));	// <-- fd can be anything
		break;
	case CMclosefiles:
		procctlclosefiles(p, 1, 0);
		break;

--
cinap

Re: [9fans] devproc procctl close bug

[erik quanstrom]

On Mon May 26 16:10:59 EDT 2014, cinap_lenrek@felloff.net wrote:
> theres a bug in devproc again.
>
> the fd is not bounds checked for the "close fd"
> procctl command and the "closefiles" command misses
> the last fd as it iterates from:

good catch.  appled patch to 9atom.

- erik

Re: [9fans] devproc procctl close bug

[cinap_lenrek]

excellent :)

--
cinap

Re: [9fans] devproc procctl close bug

[erik quanstrom]

On Mon May 26 16:32:54 EDT 2014, cinap_lenrek@felloff.net wrote:
> excellent :)

why, do you plan a plan 9 botnet that exploits this hole :-).

- erik