Bug 197246

Summary: [patch] use-after-free bug in pipe_dtor()
Product: Base System Reporter: luke.tw
Component: kernAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Some People CC: op
Priority: ---    
Version: CURRENT   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
patch for pipd_dtor() none

Description luke.tw 2015-02-01 17:23:08 UTC
Created attachment 152442 [details]
patch for pipd_dtor()

There is a use-after-free bug in pipe_dtor(). This will result in kernel panic when memguard is enabled.

* free
  pipeclose(dpipe)
  -> uma_zfree(pipe_zone, cpipe->pipe_pair);

* use
  if (dpipe->pipe_state & PIPE_NAMED) {


I attach a patch to fix this bug.
Comment 1 Oliver Pinter freebsd_committer freebsd_triage 2015-02-01 21:10:28 UTC
Hi!

We (HardenedBSD) included the patch in our master tree: https://github.com/HardenedBSD/hardenedBSD/commit/18a1157f5916ba09ae4ad5796068e46078c97104
Comment 2 commit-hook freebsd_committer freebsd_triage 2015-02-03 10:30:24 UTC
A commit references this bug:

Author: kib
Date: Tue Feb  3 10:29:41 UTC 2015
New revision: 278145
URL: https://svnweb.freebsd.org/changeset/base/278145

Log:
  Fix use after free in pipe_dtor().  PIPE_NAMED flag must be tested
  before pipeclose() is called, since for !PIPE_NAMED case, when peer is
  already closed, the pipe pair memory is freed.

  Submitted by:	luke.tw@gmail.com
  PR:	197246
  Tested by:	pho
  MFC after:	3 days

Changes:
  head/sys/kern/sys_pipe.c
Comment 3 Mark Linimon freebsd_committer freebsd_triage 2015-03-10 01:58:37 UTC
Committed as 278145.