Bug 243106 - jail(3): memory leak when resizing jail parameter list.
Summary: jail(3): memory leak when resizing jail parameter list.
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 12.1-RELEASE
Hardware: Any Any
: --- Affects Some People
Assignee: Mark Johnston
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2020-01-05 05:39 UTC by Hans Christian Woithe
Modified: 2020-01-14 02:44 UTC (History)
1 user (show)

See Also:


Attachments
proposed patch (379 bytes, patch)
2020-01-05 05:39 UTC, Hans Christian Woithe
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Hans Christian Woithe 2020-01-05 05:39:02 UTC
Created attachment 210458 [details]
proposed patch

reallocarray() is used in jailparam_all() to shrink the jail parameter list.  It appears that the final call to shrink the list is unsafe if the reallocation fails.  There is a possibility, for example, that NULL is assigned to *jpp and njp keeps its previous (likely non-zero) value.  jls, which uses jailparam_all(), will attempt to use this invalid list.

I have attached a proposed fix.
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2020-01-05 21:19:18 UTC
Assign appropriately.

fwiw, the [patch] convention has been replaced by the use of the 'patch' Keyword.
Comment 2 commit-hook freebsd_committer 2020-01-07 21:44:47 UTC
A commit references this bug:

Author: markj
Date: Tue Jan  7 21:44:27 UTC 2020
New revision: 356476
URL: https://svnweb.freebsd.org/changeset/base/356476

Log:
  libjail: Handle an error from reallocarray() when trimming the buffer.

  There is no API guarantee that realloc() will not fail when the buffer
  is shrinking.  Handle it by simply returning the untrimmed buffer.
  While this is unlikely to ever happen in practice, it seems worth
  handling just to silence static analyzer warnings.

  PR:		243106
  Submitted by:	Hans Christian Woithe <chwoithe@yahoo.com>
  MFC after:	1 week

Changes:
  head/lib/libjail/jail.c
Comment 3 commit-hook freebsd_committer 2020-01-14 02:42:44 UTC
A commit references this bug:

Author: markj
Date: Tue Jan 14 02:41:53 UTC 2020
New revision: 356718
URL: https://svnweb.freebsd.org/changeset/base/356718

Log:
  MFC r356476:
  libjail: Handle an error from reallocarray() when trimming the buffer.

  PR:	243106

Changes:
_U  stable/12/
  stable/12/lib/libjail/jail.c
Comment 4 Mark Johnston freebsd_committer 2020-01-14 02:44:08 UTC
Thanks for the report.