From nobody Thu Aug 10 17:33:44 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4RMDYN3S97z4pp4T; Thu, 10 Aug 2023 17:33:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4RMDYN2wVnz4Q5N; Thu, 10 Aug 2023 17:33:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1691688824; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+f1f/OsL1+6nnijWfDva8+8L6mOVBm1Nn6PyQlHtoVw=; b=eCT8YfEG/OFDsonKHRlfj4F5CMLrePKOtMwJnyClxQqxxWk9FSzype0aBqi726R6UyaHir YOzmfzFJo8FXpqfvTjIeBu8nWfmOvflWfHvHgnkKDgcO/u6n4izV47WD1dyBw4agTwI/q9 o+HmYoRCwWhxf6d9Q5AunEDirpxSB8zDblQ6X8YIGKfFoXa323vQN0r7JuRhoFa2s3c8Wc myxuGf4V97T17kfjnynnHReD58mjGIEScjL4HX6MBZz9hWnICzLEkIn91KHUcsT4Q4sjDl c+9CLXfmBfsfepZJVCWNdZWQ+PeecBwMYsc9LFPHWvVmBsCTWSPcGhZ+Bks3EA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1691688824; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+f1f/OsL1+6nnijWfDva8+8L6mOVBm1Nn6PyQlHtoVw=; b=guWvjUxpAsTOBXfnnZ+T7hb3F4UXAhkAxzXKSjER4yM8Hcw3Rd8JtY4XEQDLpe3wkSdsjT 5xaWcJpfrVVKmmwN5ebwk/P+rXAroE3+u8j6U6lgOxmDtBbBpDIrs8S1IL/wYAc8f7Deh7 r581fGcA4uK2FTWsMM4/tAkKryiZNMW98MBZ5P0ScaJgZl7Lpr30QKUQBY2YaH0EOQP8e5 XLB4KMHm5kf3oqfSb0yFkhHcu3uPmD9/q7QKc1E3wtz0hf3wg0VyFAFbFfv+/x75YVk4ef TREtG+wUlpDN/Mk4DkjLEYwiRYtQvpc3FvnpAbyTKxvE9G1ZWIhNvMvR23c2AQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1691688824; a=rsa-sha256; cv=none; b=RNi0dRkokELRMqOHUJtrvQ5tIffxa7t/KPisn9DBM/s0gtND0jb4AAb6sqCeQAI3jBB6J4 GbEn1uPBAQL5IZbN2R+w9USKz/47sn8pJ1D72Glxz4RHp6y+mTDccHHkymtoKcHNlP/n1K /1rWM3DwTmNz+eR5Zmet6bZyd7Xrs3SLjUO5pq8QfyhnlFaSIxFFu9e2NQvog0FCKmmevq 5lvfdtRqVAjXfQwZj0XWGs8Rz3TE6A0xzkPM8RUuOwCFBhVmYK0TKPexuiJGu0zkuKxv/1 HFEs1HgqoPC4Xt79BazKVfhxF7nqPBF6mZgLTRzIJqZCErGdDWJRB4FzP8flhQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4RMDYN1zyRz15QT; Thu, 10 Aug 2023 17:33:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 37AHXiCP042983; Thu, 10 Aug 2023 17:33:44 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 37AHXiJH042981; Thu, 10 Aug 2023 17:33:44 GMT (envelope-from git) Date: Thu, 10 Aug 2023 17:33:44 GMT Message-Id: <202308101733.37AHXiJH042981@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kyle Evans Subject: git: 2bd446d7f1a0 - main - kern: osd: avoid dereferencing freed slots List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 2bd446d7f1a03fbf6d98ace4548f8793599f48fb Auto-Submitted: auto-generated The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=2bd446d7f1a03fbf6d98ace4548f8793599f48fb commit 2bd446d7f1a03fbf6d98ace4548f8793599f48fb Author: Kyle Evans AuthorDate: 2023-08-10 17:32:33 +0000 Commit: Kyle Evans CommitDate: 2023-08-10 17:33:26 +0000 kern: osd: avoid dereferencing freed slots If a slot is freed that isn't the last one, we'll set its destructor to NULL to indicate that it's been freed and leave a hole in the slot map. Check osd_destructors in osd_call() to avoid dereferencing a method that is potentially from a module that's been unloaded. This scenario would most commonly surface when two modules are loaded that osd_register(), then the earlier one deregisters and an osd_call() is made after the fact. In the specific report that triggered the investigation, kldload if_wg -> kldload linux* -> kldunload if_wg -> destroy a jail -> panic. Noted in the review, but left for follow-up work, is that the realloc that may happen in osd_deregister() should likely go away and the assumption that reallocating to a smaller size cannot fail is actually not correct. Reported by: dim Reviewed by: markj, jamie Differential Revision: https://reviews.freebsd.org/D41404 --- sys/kern/kern_osd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sys/kern/kern_osd.c b/sys/kern/kern_osd.c index 23178731b899..ced6df31cf44 100644 --- a/sys/kern/kern_osd.c +++ b/sys/kern/kern_osd.c @@ -396,6 +396,9 @@ osd_call(u_int type, u_int method, void *obj, void *data) error = 0; sx_slock(&osdm[type].osd_module_lock); for (i = 0; i < osdm[type].osd_ntslots; i++) { + /* Hole in the slot map; avoid dereferencing. */ + if (osdm[type].osd_destructors[i] == NULL) + continue; methodfun = osdm[type].osd_methods[i * osdm[type].osd_nmethods + method]; if (methodfun != NULL && (error = methodfun(obj, data)) != 0)