Bug 266144 - bug in sndstat_unpack_user_nvlbuf()
Summary: bug in sndstat_unpack_user_nvlbuf()
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-08-31 20:54 UTC by Robert Morris
Modified: 2024-05-22 13:24 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2022-08-31 20:54:03 UTC
In this code in sndstat_unpack_user_nvlbuf() in sys/dev/sound/pcm/sndstat.c:

        *nvl = nvlist_unpack(nvlbuf, nbytes, 0);
        free(nvlbuf, M_DEVBUF);
        if (nvl == NULL) {
                return (EINVAL);
        }

I believe it should be

        if (*nvl == NULL) {

Without this fix, if nvlist_unpack() returns NULL, subsequent code
will panic when it tries to use a NULL *nvl.

A demo:

int main() {
  char *dev = "/dev/sndstat";
  int fd = open(dev, 2);
  if(fd < 0) { perror(dev); exit(1); }
  char buf2[64];
  memset(buf2, 0, sizeof(buf2));
  char buf1[128];
  memset(buf1, 0, sizeof(buf1));
  *(int*)(buf1+0) = sizeof(buf2);
  *(char**)(buf1+8) = buf2;
  ioctl(fd, 0xc0104466, buf1); // SNDSTIOC_ADD_USER_DEVS
}

panic: Assertion (nvl) != ((void *)0) failed at /usr/rtm/symbsd/src/sys/contrib/libnv/nvlist.c:387           
panic() at panic+0x2a
nvlist_find() at nvlist_find+0xd4
nvlist_exists_nvlist_array() at nvlist_exists_nvlist_array+0x10
sndstat_add_user_devs() at sndstat_add_user_devs+0x4e
sndstat_ioctl() at sndstat_ioctl+0x9e
devfs_ioctl() at devfs_ioctl+0xbe
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x30
VOP_IOCTL() at VOP_IOCTL+0x36
vn_ioctl() at vn_ioctl+0xba
devfs_ioctl_f() at devfs_ioctl_f+0x20
fo_ioctl() at fo_ioctl+0xa
kern_ioctl() at kern_ioctl+0x242
sys_ioctl() at sys_ioctl+0x120
syscallenter() at syscallenter+0xec
ecall_handler() at ecall_handler+0x18
do_trap_user() at do_trap_user+0xea
cpu_exception_handler_user() at cpu_exception_handler_user+0x72
Comment 1 Christos Margiolis freebsd_committer freebsd_triage 2024-05-17 23:38:00 UTC
Hello Robert. I hit this bug a few minutes ago and I just stumbled upon your bug report. The fix is indeed what you proposed: https://reviews.freebsd.org/D45237
Comment 2 commit-hook freebsd_committer freebsd_triage 2024-05-20 14:19:21 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=64f4e2db6d19d8ab520903a197fcaa8cc7ab9f9a

commit 64f4e2db6d19d8ab520903a197fcaa8cc7ab9f9a
Author:     Christos Margiolis <christos@FreeBSD.org>
AuthorDate: 2024-05-20 14:18:33 +0000
Commit:     Christos Margiolis <christos@FreeBSD.org>
CommitDate: 2024-05-20 14:18:33 +0000

    sound: Correctly check nvlist_unpack() error

    The current check is never false and if nvlist_unpack() fails, we might
    panic later down the road.

    PR:             266144
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 day
    Reviewed by:    dev_submerge.ch, emaste
    Differential Revision:  https://reviews.freebsd.org/D45237

 sys/dev/sound/pcm/sndstat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 3 commit-hook freebsd_committer freebsd_triage 2024-05-21 17:54:11 UTC
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=45feaa73c68011bbba647d1eb6f86a166a0453e9

commit 45feaa73c68011bbba647d1eb6f86a166a0453e9
Author:     Christos Margiolis <christos@FreeBSD.org>
AuthorDate: 2024-05-20 14:18:33 +0000
Commit:     Christos Margiolis <christos@FreeBSD.org>
CommitDate: 2024-05-21 17:45:55 +0000

    sound: Correctly check nvlist_unpack() error

    The current check is never false and if nvlist_unpack() fails, we might
    panic later down the road.

    PR:             266144
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 day
    Reviewed by:    dev_submerge.ch, emaste
    Differential Revision:  https://reviews.freebsd.org/D45237

    (cherry picked from commit 64f4e2db6d19d8ab520903a197fcaa8cc7ab9f9a)

 sys/dev/sound/pcm/sndstat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 4 commit-hook freebsd_committer freebsd_triage 2024-05-22 13:24:16 UTC
A commit in branch releng/14.1 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=8d3f96bd85c9519cef76d0727b00082354a2134b

commit 8d3f96bd85c9519cef76d0727b00082354a2134b
Author:     Christos Margiolis <christos@FreeBSD.org>
AuthorDate: 2024-05-20 14:18:33 +0000
Commit:     Christos Margiolis <christos@FreeBSD.org>
CommitDate: 2024-05-22 13:22:40 +0000

    sound: Correctly check nvlist_unpack() error

    The current check is never false and if nvlist_unpack() fails, we might
    panic later down the road.

    PR:             266144
    Sponsored by:   The FreeBSD Foundation
    MFC after:      1 day
    Reviewed by:    dev_submerge.ch, emaste
    Differential Revision:  https://reviews.freebsd.org/D45237

    (cherry picked from commit 64f4e2db6d19d8ab520903a197fcaa8cc7ab9f9a)
    (cherry picked from commit 45feaa73c68011bbba647d1eb6f86a166a0453e9)

    Approved by:    re (cperciva)

 sys/dev/sound/pcm/sndstat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)