Skip to content
Snippets Groups Projects
  • Tomasz Grabiec's avatar
    858a2289
    ramfs: fix use-after-free when ranaming files · 858a2289
    Tomasz Grabiec authored
    
    This happens when you move a file to a different directory.
    
    Thread 2 (Thread 2):
     1  0x000000000032ed3b in halt_no_interrupts ()
       at ../../arch/x64/processor.hh:239
       osv::halt () at ../../core/power.cc:28
     2  0x000000000020e7fe in abort (
        msg=msg@entry=0x580160 "page fault outside application")
        at ../../runtime.cc:109
     3  0x00000000002ecfdc in page_fault (ef=0xffffc0003e362008)
        at ../../core/mmu.cc:981
     4  <signal handler called>
     5  merge (b=0xffffc0003b4e8000, a=0xfffffffffffffff8)
        at ../../core/mempool.cc:421
     6  memory::free_page_range_locked (range=range@entry=0xffffc0003b4e8000)
        at ../../core/mempool.cc:436
     7  0x00000000003186d7 in memory::free_page_range (
        range=range@entry=0xffffc0003b4e8000) at ../../core/mempool.cc:448
     8  0x0000000000319280 in free_large (obj=0xffffc0003b4e9000)
        at ../../core/mempool.cc:460
     9  std_free (object=0xffffc0003b4e9000) at ../../core/mempool.cc:790
     10 free (obj=0xffffc0003b4e9000) at ../../core/mempool.cc:892
     11 0x0000000000340e52 in ramfs_free_node (np=np@entry=0xffffc0003d250d40)
        at ../../fs/ramfs/ramfs_vnops.c:78
     12 0x0000000000340ed2 in ramfs_remove_node (dnp=0xffffc0003d250a00,
        np=0xffffc0003d250d40) at ../../fs/ramfs/ramfs_vnops.c:131
     13 0x0000000000340ffd in ramfs_rename (dvp1=0xffffc0003fc9a180,
        vp1=0xffffc0003fc9a100, name1=<optimized out>, dvp2=0xffffc0003fc9a280,
        vp2=<optimized out>, name2=0x2000001fedf1 "prefix_suffix")
        at ../../fs/ramfs/ramfs_vnops.c:380
     14 0x0000000000340069 in sys_rename (src=<optimized out>,
        dest=<optimized out>) at ../../fs/vfs/vfs_syscalls.c:671
     15 0x000000000033a3b2 in rename (oldpath=<optimized out>,
        newpath=0xffffc0003e858cc0 "/tmp/t3-26e1b47c/prefix_suffix")
        at ../../fs/vfs/main.cc:634
    
    Signed-off-by: default avatarTomasz Grabiec <tgrabiec@cloudius-systems.com>
    858a2289
    History
    ramfs: fix use-after-free when ranaming files
    Tomasz Grabiec authored
    
    This happens when you move a file to a different directory.
    
    Thread 2 (Thread 2):
     1  0x000000000032ed3b in halt_no_interrupts ()
       at ../../arch/x64/processor.hh:239
       osv::halt () at ../../core/power.cc:28
     2  0x000000000020e7fe in abort (
        msg=msg@entry=0x580160 "page fault outside application")
        at ../../runtime.cc:109
     3  0x00000000002ecfdc in page_fault (ef=0xffffc0003e362008)
        at ../../core/mmu.cc:981
     4  <signal handler called>
     5  merge (b=0xffffc0003b4e8000, a=0xfffffffffffffff8)
        at ../../core/mempool.cc:421
     6  memory::free_page_range_locked (range=range@entry=0xffffc0003b4e8000)
        at ../../core/mempool.cc:436
     7  0x00000000003186d7 in memory::free_page_range (
        range=range@entry=0xffffc0003b4e8000) at ../../core/mempool.cc:448
     8  0x0000000000319280 in free_large (obj=0xffffc0003b4e9000)
        at ../../core/mempool.cc:460
     9  std_free (object=0xffffc0003b4e9000) at ../../core/mempool.cc:790
     10 free (obj=0xffffc0003b4e9000) at ../../core/mempool.cc:892
     11 0x0000000000340e52 in ramfs_free_node (np=np@entry=0xffffc0003d250d40)
        at ../../fs/ramfs/ramfs_vnops.c:78
     12 0x0000000000340ed2 in ramfs_remove_node (dnp=0xffffc0003d250a00,
        np=0xffffc0003d250d40) at ../../fs/ramfs/ramfs_vnops.c:131
     13 0x0000000000340ffd in ramfs_rename (dvp1=0xffffc0003fc9a180,
        vp1=0xffffc0003fc9a100, name1=<optimized out>, dvp2=0xffffc0003fc9a280,
        vp2=<optimized out>, name2=0x2000001fedf1 "prefix_suffix")
        at ../../fs/ramfs/ramfs_vnops.c:380
     14 0x0000000000340069 in sys_rename (src=<optimized out>,
        dest=<optimized out>) at ../../fs/vfs/vfs_syscalls.c:671
     15 0x000000000033a3b2 in rename (oldpath=<optimized out>,
        newpath=0xffffc0003e858cc0 "/tmp/t3-26e1b47c/prefix_suffix")
        at ../../fs/vfs/main.cc:634
    
    Signed-off-by: default avatarTomasz Grabiec <tgrabiec@cloudius-systems.com>