Bug 199518 - [patch] use uninitialized field td_sel of struct thread
Summary: [patch] use uninitialized field td_sel of struct thread
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2015-04-18 12:54 UTC by luke.tw
Modified: 2015-04-25 08:15 UTC (History)
2 users (show)

See Also:
op: mfc-stable10+


Attachments
patch for thread_init() (403 bytes, patch)
2015-04-18 12:54 UTC, luke.tw
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description luke.tw 2015-04-18 12:54:39 UTC
Created attachment 155694 [details]
patch for thread_init()

When thread_alloc() allocates struct thread from thread_zone, the field td_sel is not initialized. 
Later in seltdinit(), if td_sel is not NULL, then this field will not allocate memory.

While not easy to run into the bug in normal configuration, it is easy to panic when memguard deliberately overwrites the freed memory with 'M'.
Comment 1 commit-hook freebsd_committer 2015-04-18 17:22:10 UTC
A commit references this bug:

Author: kib
Date: Sat Apr 18 17:21:13 UTC 2015
New revision: 281696
URL: https://svnweb.freebsd.org/changeset/base/281696

Log:
  Initialize td_sel in the thread_init().  Struct thread is not zeroed
  on the initial allocation, but seltdinit() assumes that td_sel is NULL
  or a valid pointer.  Note that thread_fini()/seltdfini() also relies
  on this, but correctly resets td_sel to NULL.

  Submitted by:	luke.tw@gmail.com
  PR:	199518
  MFC after:	1 week

Changes:
  head/sys/kern/kern_thread.c
Comment 2 commit-hook freebsd_committer 2015-04-25 08:06:50 UTC
A commit references this bug:

Author: kib
Date: Sat Apr 25 08:06:22 UTC 2015
New revision: 281979
URL: https://svnweb.freebsd.org/changeset/base/281979

Log:
  MFC r281696:
  Initialize td_sel in the thread_init().

  PR:	199518

Changes:
_U  stable/10/
  stable/10/sys/kern/kern_thread.c
Comment 3 commit-hook freebsd_committer 2015-04-25 08:09:52 UTC
A commit references this bug:

Author: kib
Date: Sat Apr 25 08:09:16 UTC 2015
New revision: 281980
URL: https://svnweb.freebsd.org/changeset/base/281980

Log:
  MFC r281696:
  Initialize td_sel in the thread_init().

  PR:	199518

Changes:
_U  stable/9/sys/
  stable/9/sys/kern/kern_thread.c