Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 1 May 2017 20:04:07 +0000 (UTC)
From:      Brooks Davis <brooks@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r317660 - head/lib/libc/rpc
Message-ID:  <201705012004.v41K47IF040264@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: brooks
Date: Mon May  1 20:04:07 2017
New Revision: 317660
URL: https://svnweb.freebsd.org/changeset/base/317660

Log:
  Support clnt_raw's use of FD_SETSIZE as a fake file descriptor.
  
  Accomplish this by allocating space for it in __svc_xports and allowing
  it to be registered.  The failure to allocate space was causing an
  out-of-bounds read in svc_getreq_common().  The failure to register
  caused PR 211804.
  
  The bug was found with CHERI bounds checking.
  
  PR:		211804
  Obtained from:	CheriBSD
  Sponsored by:	DARPA, AFRL
  Reviewed by:	ngie
  MFC after:	2 weeks
  Differential Revision:	https://reviews.freebsd.org/D10528

Modified:
  head/lib/libc/rpc/svc.c

Modified: head/lib/libc/rpc/svc.c
==============================================================================
--- head/lib/libc/rpc/svc.c	Mon May  1 19:47:10 2017	(r317659)
+++ head/lib/libc/rpc/svc.c	Mon May  1 20:04:07 2017	(r317660)
@@ -108,18 +108,19 @@ xprt_register(SVCXPRT *xprt)
 	rwlock_wrlock(&svc_fd_lock);
 	if (__svc_xports == NULL) {
 		__svc_xports = (SVCXPRT **)
-			mem_alloc(FD_SETSIZE * sizeof(SVCXPRT *));
+			mem_alloc((FD_SETSIZE + 1) * sizeof(SVCXPRT *));
 		if (__svc_xports == NULL) {
 			rwlock_unlock(&svc_fd_lock);
 			return;
 		}
-		memset(__svc_xports, '\0', FD_SETSIZE * sizeof(SVCXPRT *));
+		memset(__svc_xports, '\0', (FD_SETSIZE + 1) * sizeof(SVCXPRT *));
 	}
 	if (sock < FD_SETSIZE) {
 		__svc_xports[sock] = xprt;
 		FD_SET(sock, &svc_fdset);
 		svc_maxfd = max(svc_maxfd, sock);
-	}
+	} else if (sock == FD_SETSIZE)
+		__svc_xports[sock] = xprt;
 	rwlock_unlock(&svc_fd_lock);
 }
 
@@ -157,7 +158,8 @@ __xprt_do_unregister(SVCXPRT *xprt, bool
 				if (__svc_xports[svc_maxfd])
 					break;
 		}
-	}
+	} else if ((sock == FD_SETSIZE) && (__svc_xports[sock] == xprt))
+		__svc_xports[sock] = NULL;
 	if (dolock)
 		rwlock_unlock(&svc_fd_lock);
 }

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201705012004.v41K47IF040264>