2006-10-26 18:45:54

by Jeff Layton

Subject: [PATCH 2/2] idmapd: fix use after free in dirscancb cleanup loop

The previous patch seems to expose a use after free bug in dirscancb. At
least, I could reliably reproduce a segfault by doing a bunch of mounts
and then unmounting them all. The code uses the following list macro:

TAILQ_FOREACH(ic, icq, ic_next) {

...to iterate over all of the ic entries and clean up any that no longer
have a corresponding directory in rpc_pipefs. This macro unrolls into:

for(ic=icq->tqh_first; ic != NULL; ic=ic->ic_next.tqe_next) {

...but within this loop, we can free ic, and then the for loop can trip
over that when it tries to do the iteration. The attached patch works
around this by not using the TAILQ_FOREACH macro and saving off the
tqe_next pointer prior to the free.

Again, this was tested on a patched 1.0.6, but the 1.0.10 code is very
similar, and I think the problem exists there as well.

Signed-off-by: Jeff Layton <[email protected]>

--- nfs-utils-1.0.10/utils/idmapd/idmapd.c.segv
+++ nfs-utils-1.0.10/utils/idmapd/idmapd.c
@@ -444,7 +444,7 @@ dirscancb(int fd, short which, void *dat
{
int nent, i;
struct dirent **ents;
- struct idmap_client *ic;
+ struct idmap_client *ic, *nextic;
char path[PATH_MAX];
struct idmap_clientq *icq = data;

@@ -498,7 +498,9 @@ dirscancb(int fd, short which, void *dat
}
}

- TAILQ_FOREACH(ic, icq, ic_next) {
+ ic = TAILQ_FIRST(icq);
+ while(ic != NULL) {
+ nextic=TAILQ_NEXT(ic, ic_next);
if (!ic->ic_scanned) {
event_del(&ic->ic_event);
close(ic->ic_fd);
@@ -511,6 +513,7 @@ dirscancb(int fd, short which, void *dat
free(ic);
} else
ic->ic_scanned = 0;
+ ic = nextic;
}

out:



-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

2006-10-26 19:51:22

by Kevin Coffman

Subject: Re: [PATCH 2/2] idmapd: fix use after free in dirscancb cleanup loop

Thanks for these. I will work on getting them into our patch and on
to Neil ASAP.

On 10/26/06, Jeff Layton <[email protected]> wrote:
> The previous patch seems to expose a use after free bug in dirscancb. At
> least, I could reliably reproduce a segfault by doing a bunch of mounts
> and then unmounting them all. The code uses the following list macro:

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs