From owner-freebsd-bugs@FreeBSD.ORG Wed Oct 10 22:58:23 2012 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 69323F7B for ; Wed, 10 Oct 2012 22:58:23 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [8.8.178.135]) by mx1.freebsd.org (Postfix) with ESMTP id 27AF78FC18 for ; Wed, 10 Oct 2012 22:58:23 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q9AMwND6003776 for ; Wed, 10 Oct 2012 22:58:23 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q9AMwNDh003775; Wed, 10 Oct 2012 22:58:23 GMT (envelope-from gnats) Resent-Date: Wed, 10 Oct 2012 22:58:23 GMT Resent-Message-Id: <201210102258.q9AMwNDh003775@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Ritesh Shah Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 8B606780 for ; Wed, 10 Oct 2012 22:25:48 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 749B98FC17 for ; Wed, 10 Oct 2012 22:25:48 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.5/8.14.5) with ESMTP id q9AMPmrF040034 for ; Wed, 10 Oct 2012 22:25:48 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.5/8.14.5/Submit) id q9AMPmTF040017; Wed, 10 Oct 2012 22:25:48 GMT (envelope-from nobody) Message-Id: <201210102225.q9AMPmTF040017@red.freebsd.org> Date: Wed, 10 Oct 2012 22:25:48 GMT From: Ritesh Shah To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Subject: misc/172576: librpc segfaults when out of memory X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Oct 2012 22:58:23 -0000 >Number: 172576 >Category: misc >Synopsis: librpc segfaults when out of memory >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Oct 10 22:58:22 UTC 2012 >Closed-Date: >Last-Modified: >Originator: Ritesh Shah >Release: 7.2, 8.1, 9.0 >Organization: >Environment: 7.2-RELEASE-p4 FreeBSD 7.2-RELEASE-p4 #0: Fri Oct 2 08:22:32 UTC 2009 root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC amd64 >Description: xdrrec_create() routine in lib/libc/xdr/xdr_rec.c returns a void. Under low memory condition this routine can bail out early and leave part of the XDR structrure uninitialized. The callers : clnt_vc_create() in lib/libc/rpc/clnt_vc.c & makefd_xprt() in lib/libc/rpc/svc_vc.c do not check whether failed or not. This can lead to segfault when uninitialized pointers are accessed. This bug exists in FreeBSD 9 as well. 192 rstrm->in_base = mem_alloc(recvsize); 193 if (rstrm->in_base == NULL) { 194 warnx("xdrrec_create: out of memory"); 195 mem_free(rstrm->out_base, sendsize); 196 mem_free(rstrm, sizeof(RECSTREAM)); 197 return; 198 } 199 /* 200 * now the rest ... 201 */ 202 xdrs->x_ops = &xdrrec_ops; 203 xdrs->x_private = rstrm; 204 rstrm->tcp_handle = tcp_handle; >How-To-Repeat: >Fix: It has been reported against netbsd as well. http://mail-index.netbsd.org/netbsd-bugs/2012/08/06/msg029375.html I can provide a patch if there is an agreement on how it should be fixed. >Release-Note: >Audit-Trail: >Unformatted: