From owner-freebsd-bugs@FreeBSD.ORG Wed Dec 16 21:30:05 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 429B0106566C for ; Wed, 16 Dec 2009 21:30:05 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 06A408FC1A for ; Wed, 16 Dec 2009 21:30:05 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id nBGLU424058559 for ; Wed, 16 Dec 2009 21:30:04 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id nBGLU4TZ058554; Wed, 16 Dec 2009 21:30:04 GMT (envelope-from gnats) Resent-Date: Wed, 16 Dec 2009 21:30:04 GMT Resent-Message-Id: <200912162130.nBGLU4TZ058554@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Markiyan Kushnir Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9E6CC1065670 for ; Wed, 16 Dec 2009 21:25:50 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 744E18FC08 for ; Wed, 16 Dec 2009 21:25:50 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id nBGLPobT034939 for ; Wed, 16 Dec 2009 21:25:50 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id nBGLPoXb034938; Wed, 16 Dec 2009 21:25:50 GMT (envelope-from nobody) Message-Id: <200912162125.nBGLPoXb034938@www.freebsd.org> Date: Wed, 16 Dec 2009 21:25:50 GMT From: Markiyan Kushnir To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: bin/141692: Segmentation fault in jls -jJNAME X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Dec 2009 21:30:05 -0000 >Number: 141692 >Category: bin >Synopsis: Segmentation fault in jls -jJNAME >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Dec 16 21:30:04 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Markiyan Kushnir >Release: 8.0-STABLE >Organization: Lohika Systems >Environment: FreeBSD localhost 8.0-STABLE FreeBSD 8.0-STABLE #2: Fri Dec 11 00:54:35 EET 2009 root@localhost:/usr/obj/usr/src/sys/MAREK i386 >Description: jls(8) with a jail name (not jid) supplied using the -j option, regardless of whether it is existing name or not, fails with a segfault. After some code review of lib/libjail/jail.c, found an attempt of possible NULL pointer dereference, lines 534-535 (v 1.3.2.1). A workaround is proposed to "preventively" supply a valid buffer for the jid parameter in jls.c >How-To-Repeat: jls -j asdasd Or compile with -ljail this simple demo: #include #include #include #include #include int main (void) { char * hostname; struct jailparam params[3]; int res; if (jailparam_init(¶ms[0], "name") != 0) { perror("jailparam_init name"); } /* setup name as a key parameter */ if (jailparam_import(¶ms[0], "asdf") != 0) { perror("jailparam_import asdf"); } if (jailparam_init(¶ms[1], "host.hostname") != 0) { perror("jailparam_init host.hostname"); } /* jid is not the key parameter */ if (jailparam_init(¶ms[2], "jid") != 0) { perror("jailparam_init"); } if ((res = jailparam_get(params, 3, 0)) == -1) { perror("jailparam_get"); } hostname = jailparam_export(¶ms[1]); printf("hostname='%s'\n", hostname); jailparam_free(params, 3); return 0; } >Fix: The library function jailparam_get(3) makes an assumption that only jid or lastjid can be key parameters. No such condition is mentioned in the man 3 jail. The workaround to jls is proposed in the attachment. True fix would require a bit more research in the libjail. Patch attached with submission follows: --- /usr/src/usr.sbin/jls/jls.c 2009-08-12 15:31:29.000000000 +0300 +++ jls.c 2009-12-16 22:27:13.000000000 +0200 @@ -115,7 +115,7 @@ if (pflags & (PRINT_HEADER | PRINT_NAMEVAL)) add_param("all", NULL, (size_t)0, NULL, JP_USER); else if (pflags & PRINT_VERBOSE) { - add_param("jid", NULL, (size_t)0, NULL, JP_USER); + add_param("jid", &jid, sizeof(jid), NULL, JP_USER); add_param("host.hostname", NULL, (size_t)0, NULL, JP_USER); add_param("path", NULL, (size_t)0, NULL, JP_USER); @@ -127,7 +127,7 @@ JP_USER | JP_OPT); } else { pflags |= PRINT_DEFAULT; - add_param("jid", NULL, (size_t)0, NULL, JP_USER); + add_param("jid", &jid, sizeof(jid), NULL, JP_USER); add_param("ip4.addr", NULL, (size_t)0, NULL, JP_USER); add_param("host.hostname", NULL, (size_t)0, NULL, JP_USER); >Release-Note: >Audit-Trail: >Unformatted: