lib9p: fix mem leaks and use-after-free in socket.c
AcceptedPublic
Actions

Authored by njain15_protonmail.com on Tue, Aug 4, 1:27 AM.

Details

Reviewers

Summary

Currently, the socket receiving thread hands the request off to the threadpool and prematurely frees the request payload. Anyone using it later (ex. TWRITE), reads garbage data. Suggested fix is to free the request buffer only when we're sending a response for that request, since it will not be used after that.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Event Timeline

njain15_protonmail.com created this revision.Tue, Aug 4, 1:27 AM

Herald added a reviewer: bhyve. · View Herald TranscriptTue, Aug 4, 1:27 AM

Herald added subscribers: bcran, rgrimes, imp. · View Herald Transcript

njain15_protonmail.com requested review of this revision.Tue, Aug 4, 1:27 AM

njain15_protonmail.com removed a reviewer: bhyve.Tue, Aug 4, 1:38 AM

njain15_protonmail.com removed subscribers: rgrimes, bcran.

njain15_protonmail.com added a reviewer: markj.Tue, Aug 4, 1:54 AM

markj added inline comments.Tue, Aug 4, 8:43 PM

contrib/lib9p/transport/socket.c
319	Does this function need to free the request buffer too?
usr.sbin/bhyve/pci_virtio_9p.c
216

Yes, sorry about that.

This technically requires a version bump for lib9p.so.1, since the library ABI changed. In practice I think it is not worth bothering: lib9p was added to FreeBSD specifically for bhyve and probably doesn't have any other consumers. It should have been added as a private library. I'll write a patch for that and request an exp-run.

This revision is now accepted and ready to land.Thu, Aug 13, 3:55 PM

markj mentioned this in D58828: lib9p: Make it a private library.Thu, Aug 13, 3:57 PM