Page MenuHomeFreeBSD

sysctl: Do not touch the name of environment variable
AbandonedPublic

Authored by zlei on Sep 21 2023, 5:26 PM.
Tags
None
Referenced Files
F108431787: D41930.id.diff
Fri, Jan 24, 5:36 PM
Unknown Object (File)
Dec 14 2024, 6:14 PM
Unknown Object (File)
Nov 27 2024, 1:44 PM
Unknown Object (File)
Sep 21 2024, 3:00 PM
Unknown Object (File)
Sep 20 2024, 6:39 PM
Unknown Object (File)
Sep 20 2024, 8:59 AM
Unknown Object (File)
Sep 17 2024, 5:58 AM
Unknown Object (File)
Sep 16 2024, 9:14 PM
Subscribers

Details

Reviewers
glebius
Summary

The second argument of event handler function env_change_fn is the
name of environment variable. It is not meant to be changed during
event handler invoking and should be declared as const char *.

Failing to do so can lead to page fault:

kdb_enter() at kdb_enter+0x32/frame 0xffffffff821658e0
vpanic() at vpanic+0x163/frame 0xffffffff82165a10
panic() at panic+0x43/frame 0xffffffff82165a70
vm_fault() at vm_fault+0x18c9/frame 0xffffffff82165ba0
vm_fault_trap() at vm_fault_trap+0x6f/frame 0xffffffff82165be0
trap_pfault() at trap_pfault+0x24a/frame 0xffffffff82165c50
calltrap() at calltrap+0x8/frame 0xffffffff82165c50

  • trap 0xc, rip = 0xffffffff80c6f39b, rsp = 0xffffffff82165d20, rbp = 0xffffffff82165d20 ---

strsep() at strsep+0x3b/frame 0xffffffff82165d20
name2oid() at name2oid+0x66/frame 0xffffffff82165d70
sysctl_setenv_vnet() at sysctl_setenv_vnet+0x38/frame 0xffffffff82165e00
kern_setenv() at kern_setenv+0x324/frame 0xffffffff82165e40
nfs_setup_diskless() at nfs_setup_diskless+0x4b2/frame 0xffffffff82165f90
nfs_rootconf() at nfs_rootconf+0x9/frame 0xffffffff82165fa0
mi_startup() at mi_startup+0x1c8/frame 0xffffffff82165ff0

Reported by: pho
Tested by: pho
Fixes: cf7974fd9e55 sysctl: Update 'master' copy of vnet SYSCTLs...
MFC after: 2 weeks

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped

Event Timeline

zlei requested review of this revision.Sep 21 2023, 5:26 PM

I'd like to avoid allocating memory. What if we:

  1. constify argument to name2oid()
  2. In name2oid() use strchr() instead of strsep()
  3. Provide sysctl_find_oidname_n() which will be very like sysctl_find_oidname() except using strncmp() instead of strcmp() and also having constified argument
zlei added a subscriber: mav.

Abandoned.

@mav has just committed f80babf906b7 (kern_sysctl: Make name2oid() non-destructive to the name), that should fix the issue perfectly.