Date: Tue, 22 Jul 2008 03:31:08 GMT From: Nathan Whitehorn <nwhitehorn@FreeBSD.org> To: freebsd-gnats-submit@FreeBSD.org Subject: kern/125849: nfs_decode_args() reads invalid memory when called from userspace Message-ID: <200807220331.m6M3V8cD055528@www.freebsd.org> Resent-Message-ID: <200807220340.m6M3e3wu023371@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 125849 >Category: kern >Synopsis: nfs_decode_args() reads invalid memory when called from userspace >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Jul 22 03:40:03 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Nathan Whitehorn >Release: 8.0-CURRENT >Organization: University of Wisconsin >Environment: FreeBSD ceto.tachypleus.net 8.0-CURRENT FreeBSD 8.0-CURRENT #729: Mon Jul 21 17:58:55 CDT 2008 root@trantor.tachypleus.net:/usr/obj/powerpc/usr/src/sys/CETO powerpc >Description: Starting with revision 1.206 of nfs_vfsops.c, the function nfs_decode_args() terminates by doing strlcpy(nmp->nm_hostname, argp->hostname, sizeof(nmp->nm_hostname) p = strchr(nmp->nm_hostname, ':'); if (p) *p = '\0'; When called from userspace by updating a mount (as happens when an NFS root is remounted read-only), argp->hostname is a pointer in the address space of the calling userspace code. Since the kernel doesn't do copyin(), it copies potentially invalid memory. On 64-bit PowerPC systems, this causes a kernel panic. since low memory is not generally mapped into kernel space. >How-To-Repeat: >Fix: I'm not sure what this code is for -- the commit message is about other code -- and removing it seems harmless. >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200807220331.m6M3V8cD055528>