Aren
/
NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
NetBSD/common/lib/libprop/prop_stack.h

65 lines
2.2 KiB
C
Raw Normal View History

Avoid using unbound amount of stack frames in prop_object_equal by using a dynamic stack as well. Reorder arguments for the internalizer as the iteration is always present and should go before possibly NULL arguments. Reviewed by mjf@ and adrianp@
2007-08-30 16:23:53 +04:00
/* $NetBSD: prop_stack.h,v 1.2 2007/08/30 12:23:54 joerg Exp $ */
libprop is currently using a recursive parser. While this is fine for userland, deeply nested arrays and dictionaries can easily overflow the kernel stack and thereby force a panic. Fix the internalizer and prop_object_release to use a separate call stack and alter the dictionary and array handling to not recurse on the C stack. The default stack has an inline depth of 16 elements, which should keep the overhead reasonable. This issue was found by Pavel Cahyna and Jachym Holecek. Additionally add a limit for prop_object_copyin_ioctl to prevent user programs from temporary allocating unbound amount of kernel memory. Allow malloc to fail so that tight loops of userland processes can't force panics by exhausting the kernel map. Tested with the sample exploit of Jachym, his test suite and reviewed by himself (initial patch), Christos Zoulas and Jason Thorpe.
2007-08-17 01:44:06 +04:00
/*-
* Copyright (c) 2007 Joerg Sonnenberger <joerg@NetBSD.org>.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#ifndef _PROP_STACK_H
#define _PROP_STACK_H
#include <sys/queue.h>
#include <prop/prop_object.h>
struct _prop_stack_intern_elem {
prop_object_t object;
Avoid using unbound amount of stack frames in prop_object_equal by using a dynamic stack as well. Reorder arguments for the internalizer as the iteration is always present and should go before possibly NULL arguments. Reviewed by mjf@ and adrianp@
2007-08-30 16:23:53 +04:00
void *object_data[3];
libprop is currently using a recursive parser. While this is fine for userland, deeply nested arrays and dictionaries can easily overflow the kernel stack and thereby force a panic. Fix the internalizer and prop_object_release to use a separate call stack and alter the dictionary and array handling to not recurse on the C stack. The default stack has an inline depth of 16 elements, which should keep the overhead reasonable. This issue was found by Pavel Cahyna and Jachym Holecek. Additionally add a limit for prop_object_copyin_ioctl to prevent user programs from temporary allocating unbound amount of kernel memory. Allow malloc to fail so that tight loops of userland processes can't force panics by exhausting the kernel map. Tested with the sample exploit of Jachym, his test suite and reviewed by himself (initial patch), Christos Zoulas and Jason Thorpe.
2007-08-17 01:44:06 +04:00
};
struct _prop_stack_extern_elem {
SLIST_ENTRY(_prop_stack_extern_elem) stack_link;
prop_object_t object;
Avoid using unbound amount of stack frames in prop_object_equal by using a dynamic stack as well. Reorder arguments for the internalizer as the iteration is always present and should go before possibly NULL arguments. Reviewed by mjf@ and adrianp@
2007-08-30 16:23:53 +04:00
void *object_data[3];
libprop is currently using a recursive parser. While this is fine for userland, deeply nested arrays and dictionaries can easily overflow the kernel stack and thereby force a panic. Fix the internalizer and prop_object_release to use a separate call stack and alter the dictionary and array handling to not recurse on the C stack. The default stack has an inline depth of 16 elements, which should keep the overhead reasonable. This issue was found by Pavel Cahyna and Jachym Holecek. Additionally add a limit for prop_object_copyin_ioctl to prevent user programs from temporary allocating unbound amount of kernel memory. Allow malloc to fail so that tight loops of userland processes can't force panics by exhausting the kernel map. Tested with the sample exploit of Jachym, his test suite and reviewed by himself (initial patch), Christos Zoulas and Jason Thorpe.
2007-08-17 01:44:06 +04:00
};
#define PROP_STACK_INTERN_ELEMS 16
struct _prop_stack {
struct _prop_stack_intern_elem intern_elems[PROP_STACK_INTERN_ELEMS];
size_t used_intern_elems;
SLIST_HEAD(, _prop_stack_extern_elem) extern_elems;
};
typedef struct _prop_stack *prop_stack_t;
void _prop_stack_init(prop_stack_t);
Avoid using unbound amount of stack frames in prop_object_equal by using a dynamic stack as well. Reorder arguments for the internalizer as the iteration is always present and should go before possibly NULL arguments. Reviewed by mjf@ and adrianp@
2007-08-30 16:23:53 +04:00
bool _prop_stack_push(prop_stack_t, prop_object_t, void *, void *, void *);
bool _prop_stack_pop(prop_stack_t, prop_object_t *, void **, void **, void **);
libprop is currently using a recursive parser. While this is fine for userland, deeply nested arrays and dictionaries can easily overflow the kernel stack and thereby force a panic. Fix the internalizer and prop_object_release to use a separate call stack and alter the dictionary and array handling to not recurse on the C stack. The default stack has an inline depth of 16 elements, which should keep the overhead reasonable. This issue was found by Pavel Cahyna and Jachym Holecek. Additionally add a limit for prop_object_copyin_ioctl to prevent user programs from temporary allocating unbound amount of kernel memory. Allow malloc to fail so that tight loops of userland processes can't force panics by exhausting the kernel map. Tested with the sample exploit of Jachym, his test suite and reviewed by himself (initial patch), Christos Zoulas and Jason Thorpe.
2007-08-17 01:44:06 +04:00
#endif