From nobody@FreeBSD.org  Wed Dec 16 21:25:50 2009
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 9E6CC1065670
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 16 Dec 2009 21:25:50 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21])
	by mx1.freebsd.org (Postfix) with ESMTP id 744E18FC08
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 16 Dec 2009 21:25:50 +0000 (UTC)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.14.3/8.14.3) with ESMTP id nBGLPobT034939
	for <freebsd-gnats-submit@FreeBSD.org>; Wed, 16 Dec 2009 21:25:50 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.14.3/8.14.3/Submit) id nBGLPoXb034938;
	Wed, 16 Dec 2009 21:25:50 GMT
	(envelope-from nobody)
Message-Id: <200912162125.nBGLPoXb034938@www.freebsd.org>
Date: Wed, 16 Dec 2009 21:25:50 GMT
From: Markiyan Kushnir <mkushnir@lohika.com>
To: freebsd-gnats-submit@FreeBSD.org
Subject: Segmentation fault in jls -jJNAME
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         141692
>Category:       bin
>Synopsis:       [patch] jls(8): Segmentation fault in jls -jJNAME
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Dec 16 21:30:04 UTC 2009
>Closed-Date:    Sun Dec 20 04:52:54 UTC 2009
>Last-Modified:  Sun Dec 20 04:52:54 UTC 2009
>Originator:     Markiyan Kushnir
>Release:        8.0-STABLE
>Organization:
Lohika Systems
>Environment:
FreeBSD localhost 8.0-STABLE FreeBSD 8.0-STABLE #2: Fri Dec 11 00:54:35 EET 2009     root@localhost:/usr/obj/usr/src/sys/MAREK  i386

>Description:
jls(8) with a jail name (not jid) supplied using the -j option, regardless of whether it is existing name or not, fails with a segfault. After some code review of lib/libjail/jail.c, found an attempt of possible NULL pointer dereference, lines 534-535 (v 1.3.2.1). A workaround is proposed to "preventively" supply a valid buffer for the jid parameter in jls.c
>How-To-Repeat:
jls -j asdasd

Or compile with -ljail this simple demo:

#include <stdlib.h>
#include <stdio.h>
#include <sys/param.h>
#include <sys/jail.h>
#include <jail.h>
int
main (void)
{
  char * hostname;
  struct jailparam params[3];
  int res;

  if (jailparam_init(&params[0], "name") != 0) {
    perror("jailparam_init name");
  }
  /* setup name as a key parameter */
  if (jailparam_import(&params[0], "asdf") != 0) {
    perror("jailparam_import asdf");
  }

  if (jailparam_init(&params[1], "host.hostname") != 0) {
    perror("jailparam_init host.hostname");
  }

  /* jid is not the key parameter */
  if (jailparam_init(&params[2], "jid") != 0) {
    perror("jailparam_init");
  }

  if ((res = jailparam_get(params, 3, 0)) == -1) {
    perror("jailparam_get");
  }

  hostname = jailparam_export(&params[1]);
  printf("hostname='%s'\n", hostname);
  jailparam_free(params, 3);
  return 0;
}

>Fix:
The library function jailparam_get(3) makes an assumption that only jid or lastjid can be key parameters. No such condition is mentioned in the man 3 jail.

The workaround to jls is proposed in the attachment. True fix would require a bit more research in the libjail.

Patch attached with submission follows:

--- /usr/src/usr.sbin/jls/jls.c	2009-08-12 15:31:29.000000000 +0300
+++ jls.c	2009-12-16 22:27:13.000000000 +0200
@@ -115,7 +115,7 @@
 		if (pflags & (PRINT_HEADER | PRINT_NAMEVAL))
 			add_param("all", NULL, (size_t)0, NULL, JP_USER);
 		else if (pflags & PRINT_VERBOSE) {
-			add_param("jid", NULL, (size_t)0, NULL, JP_USER);
+			add_param("jid", &jid, sizeof(jid), NULL, JP_USER);
 			add_param("host.hostname", NULL, (size_t)0, NULL,
 			    JP_USER);
 			add_param("path", NULL, (size_t)0, NULL, JP_USER);
@@ -127,7 +127,7 @@
 			    JP_USER | JP_OPT);
 		} else {
 			pflags |= PRINT_DEFAULT;
-			add_param("jid", NULL, (size_t)0, NULL, JP_USER);
+			add_param("jid", &jid, sizeof(jid), NULL, JP_USER);
 			add_param("ip4.addr", NULL, (size_t)0, NULL, JP_USER);
 			add_param("host.hostname", NULL, (size_t)0, NULL,
 			    JP_USER);


>Release-Note:
>Audit-Trail:

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/141692: commit references a PR
Date: Thu, 17 Dec 2009 05:07:10 +0000 (UTC)

 Author: jamie
 Date: Thu Dec 17 05:06:56 2009
 New Revision: 200623
 URL: http://svn.freebsd.org/changeset/base/200623
 
 Log:
   Add a null pointer check so "name" can be used as a key parameter in
   jailparam_get.
   
   PR:		bin/141692
   Submitted by:	delphij
   MFC after:	3 days
 
 Modified:
   head/lib/libjail/jail.c
 
 Modified: head/lib/libjail/jail.c
 ==============================================================================
 --- head/lib/libjail/jail.c	Thu Dec 17 02:06:07 2009	(r200622)
 +++ head/lib/libjail/jail.c	Thu Dec 17 05:06:56 2009	(r200623)
 @@ -532,7 +532,7 @@ jailparam_get(struct jailparam *jp, unsi
  	}
  	jp_key = jp_lastjid ? jp_lastjid :
  	    jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
 -	    *(int *)jp_jid->jp_value ? jp_jid : jp_name;
 +	    jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
  	if (jp_key == NULL || jp_key->jp_value == NULL) {
  		strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
  		errno = ENOENT;
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/141692: commit references a PR
Date: Sun, 20 Dec 2009 04:49:47 +0000 (UTC)

 Author: jamie
 Date: Sun Dec 20 04:49:29 2009
 New Revision: 200750
 URL: http://svn.freebsd.org/changeset/base/200750
 
 Log:
   MFC r200623:
   
     Add a null pointer check so "name" can be used as a key parameter in
     jailparam_get.
   
   PR:		bin/141692
   Submitted by:	delphij
 
 Modified:
   stable/8/lib/libjail/jail.c
 Directory Properties:
   stable/8/lib/libjail/   (props changed)
 
 Modified: stable/8/lib/libjail/jail.c
 ==============================================================================
 --- stable/8/lib/libjail/jail.c	Sun Dec 20 04:45:32 2009	(r200749)
 +++ stable/8/lib/libjail/jail.c	Sun Dec 20 04:49:29 2009	(r200750)
 @@ -532,7 +532,7 @@ jailparam_get(struct jailparam *jp, unsi
  	}
  	jp_key = jp_lastjid ? jp_lastjid :
  	    jp_jid && jp_jid->jp_valuelen == sizeof(int) &&
 -	    *(int *)jp_jid->jp_value ? jp_jid : jp_name;
 +	    jp_jid->jp_value && *(int *)jp_jid->jp_value ? jp_jid : jp_name;
  	if (jp_key == NULL || jp_key->jp_value == NULL) {
  		strlcpy(jail_errmsg, "no jail specified", JAIL_ERRMSGLEN);
  		errno = ENOENT;
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->closed 
State-Changed-By: jamie 
State-Changed-When: Sun Dec 20 04:52:00 UTC 2009 
State-Changed-Why:  
Fixed by r200623 

http://www.freebsd.org/cgi/query-pr.cgi?pr=141692 
>Unformatted:
