Page MenuHomeFreeBSD

libgeom: Fix segfault in 32-on-64 case
ClosedPublic

Authored by des on Fri, Jan 2, 12:26 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sat, Jan 10, 5:22 AM
Unknown Object (File)
Thu, Jan 8, 5:56 AM
Unknown Object (File)
Wed, Jan 7, 2:50 PM
Unknown Object (File)
Wed, Jan 7, 1:12 PM
Unknown Object (File)
Wed, Jan 7, 2:03 AM
Unknown Object (File)
Tue, Jan 6, 10:54 PM
Unknown Object (File)
Tue, Jan 6, 4:13 AM
Unknown Object (File)
Mon, Jan 5, 6:37 AM

Details

Summary

We were using strtoul() to parse object identifiers, which are kernel
pointers. This works fine as long as the kernel and userland match,
but in a 32-bit libgeom on a 64-bit kernel this will return ULONG_MAX
for all objects, resulting in memory corruption when we later pick the
wrong object while resolving consumer-producer references.

MFC after: 1 week
PR: 292127

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

des requested review of this revision.Fri, Jan 2, 12:26 PM
This revision is now accepted and ready to land.Fri, Jan 2, 1:07 PM

Looking at the history, a fix in this area was tried 13 years ago and reverted for breaking devstat use. 12 years ago the below type of fix was committed instead and then reverted, sighting lessons learned from the prior attempt.

devstat may need to be tested with this change in place.

We're still truncating to a 32-bit void * so the opportunity for a bugs remain (even if in practice it's essentially impossible). I think it's at least worth a comment in the src explaining why the truncation is acceptable.

This revision was automatically updated to reflect the committed changes.