From: Russ Cox <rsc@swtch.com>
To: Fans of the OS Plan 9 from Bell Labs <9fans@9fans.net>
Subject: Re: [9fans] Kernel crash bug
Date: Sat, 1 Aug 2009 15:08:14 -0700 [thread overview]
Message-ID: <dd6fe68a0908011508u64d7a7cbobc4c60fcd48d0769@mail.gmail.com> (raw)
In-Reply-To: <acfe2c8ff2577b95456cb02b1af3e6ef@terzarima.net>
calling vmemchr assumes that the memory isn't being changed
by some other proc mapping the same page. if you find the
NUL in one pass and then call strcpy or strlen on the pointer
later, the other proc might have pulled the NUL in the interim.
there is a function in the kernel called validnamedup
that both validates a string argument and at the same time
makes an in-kernel-memory copy. it's the easiest safe
way to handle strings passed to the kernel. namec uses
it and luckily almost every string pointer passed to the kernel
ends up being interpreted by namec. exec is an exception.
when i was working on 9vx, i rewrote exec to remove
crashes like this one as well as a handful of other bugs.
the code is at
http://code.swtch.com/vx32/src/tip/src/9vx/a/sysproc.c#cl-220
and could easily be dropped back into plan 9.
russ
next prev parent reply other threads:[~2009-08-01 22:08 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-08-01 21:01 Elizabeth Jones
2009-08-01 21:37 ` cinap_lenrek
2009-08-01 22:01 ` Charles Forsyth
2009-08-01 22:08 ` Russ Cox [this message]
2009-08-01 22:47 ` Elizabeth Jones
2009-08-01 23:09 ` Russ Cox
2009-08-01 23:15 ` cinap_lenrek
2009-08-02 1:38 ` erik quanstrom
2009-08-02 2:13 ` erik quanstrom
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dd6fe68a0908011508u64d7a7cbobc4c60fcd48d0769@mail.gmail.com \
--to=rsc@swtch.com \
--cc=9fans@9fans.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).