NetBSD Problem Report #44648

From campbell@mumble.net  Sun Feb 27 22:47:48 2011
Return-Path: <campbell@mumble.net>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id 05F4C63B8A7
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 27 Feb 2011 22:47:48 +0000 (UTC)
Message-Id: <20110227224723.E5EB298298@pluto.mumble.net>
Date: Sun, 27 Feb 2011 22:47:23 +0000 (UTC)
From: Taylor R Campbell <campbell+netbsd@mumble.net>
Reply-To: Taylor R Campbell <campbell+netbsd@mumble.net>
To: gnats-bugs@gnats.NetBSD.org
Subject: access("/tmp/lose", 8) panics when /tmp is on tmpfs
X-Send-Pr-Version: 3.95

>Number:         44648
>Category:       kern
>Synopsis:       access("/tmp/lose", 8) panics when /tmp is on tmpfs
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Feb 27 22:50:00 +0000 2011
>Closed-Date:    Mon Mar 21 02:08:23 +0000 2011
>Last-Modified:  Mon Mar 21 02:08:23 +0000 2011
>Originator:     Taylor R Campbell <campbell+netbsd@mumble.net>
>Release:        NetBSD 5.99.46
>Organization:
>Environment:
System: NetBSD oberon.local 5.99.46 NetBSD 5.99.46 (RIAMONODEBUG) #30: Fri Feb 25 21:04:59 UTC 2011 riastradh@smalltalk.local:/home/riastradh/netbsd/current/obj/sys/arch/i386/compile/RIAMONODEBUG i386
Architecture: i386
Machine: i386
>Description:

	access("/tmp/lose", 8) causes the flags argument to VOP_ACCESS
	in sys_access to be zero.  tmpfs_access passes the zero flags
	through kauth_mode_to_action, which yields a zero action for
	kauth_authorize_vnode, where kauth_authorize_action_internal
	asserts that the action is nonzero.

	I don't know what program does this, or whether any program
	actually did -- it happened during a bulk build on a MacBook1,1
	(dual-core i386) with a -current kernel, on which I have seen
	bizarre behaviour, panics, and silent reboots recently.  The
	bulk build was at sysutils/cdrtools, which I've built several
	times before, so I suspect something else is afoot.

>How-To-Repeat:

	The following program reliably makes NetBSD panic for me if I
	pass it the pathname of a file in a tmpfs:

#include <err.h>
#include <unistd.h>

int
main(int argc, char **argv)
{
	if (argc != 2)
		err(1, "Usage: %s <pathname>\n", argv[0]);
	if (access(argv[1], 8) == -1)
		err(1, "access");
	return (0);
}

>Fix:

	Apply the following patch to vfs_syscalls.c.  It would have
	sufficed to change `if (SCARG(uap, flags))' to `if (SCARG(uap,
	flags) & (R_OK | W_OK | X_OK))', but this will help to flag
	broken programs.  (Actually, just changing access(2) to return
	EINVAL all the time would help to flag broken programs, but
	that's a separate issue...)

Index: vfs_syscalls.c
===================================================================
RCS file: /cvsroot/src/sys/kern/vfs_syscalls.c,v
retrieving revision 1.414
diff -p -u -r1.414 vfs_syscalls.c
--- vfs_syscalls.c	13 Jan 2011 07:25:50 -0000	1.414
+++ vfs_syscalls.c	27 Feb 2011 22:37:47 -0000
@@ -2504,7 +2504,9 @@ sys_access(struct lwp *l, const struct s
 	pathbuf_destroy(pb);

 	/* Flags == 0 means only check for existence. */
-	if (SCARG(uap, flags)) {
+	if (SCARG(uap, flags) &~ (R_OK | W_OK | X_OK)) {
+		error = EINVAL;
+	} else if (SCARG(uap, flags)) {
 		flags = 0;
 		if (SCARG(uap, flags) & R_OK)
 			flags |= VREAD;

>Release-Note:

>Audit-Trail:
From: "David A. Holland" <dholland@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44648 CVS commit: src/sys/kern
Date: Sun, 27 Feb 2011 23:06:41 +0000

 Module Name:	src
 Committed By:	dholland
 Date:		Sun Feb 27 23:06:41 UTC 2011

 Modified Files:
 	src/sys/kern: vfs_syscalls.c

 Log Message:
 Check for bogus flags to access() up front. Otherwise we end up
 calling VOP_ACCESS with flags 0 and something asserts deep in the
 bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
 earlier relative to the suggested patch.)

 Pullup candidate.


 To generate a diff of this commit:
 cvs rdiff -u -r1.414 -r1.415 src/sys/kern/vfs_syscalls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->pending-pullups
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sun, 27 Feb 2011 23:48:18 +0000
State-Changed-Why:
pullup-5 #1567, pullup-4 #1417.
There doesn't appear to be any code path in -5 that leads to a crash
(and therefore, presumably not in -4 either) but it's still a bug.


From: "Antti Kantee" <pooka@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44648 CVS commit: src/tests/fs/vfs
Date: Mon, 28 Feb 2011 03:40:45 +0000

 Module Name:	src
 Committed By:	pooka
 Date:		Mon Feb 28 03:40:45 UTC 2011

 Modified Files:
 	src/tests/fs/vfs: t_vnops.c

 Log Message:
 Add simple test case for access(2), including panicky scenario from
 PR kern/44648.


 To generate a diff of this commit:
 cvs rdiff -u -r1.14 -r1.15 src/tests/fs/vfs/t_vnops.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Manuel Bouyer" <bouyer@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44648 CVS commit: [netbsd-4] src/sys/kern
Date: Sun, 20 Mar 2011 20:36:57 +0000

 Module Name:	src
 Committed By:	bouyer
 Date:		Sun Mar 20 20:36:57 UTC 2011

 Modified Files:
 	src/sys/kern [netbsd-4]: vfs_syscalls.c

 Log Message:
 Pull up following revision(s) (requested by dholland in ticket #1417):
 	sys/kern/vfs_syscalls.c: revision 1.415 via patch
 Check for bogus flags to access() up front. Otherwise we end up
 calling VOP_ACCESS with flags 0 and something asserts deep in the
 bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
 earlier relative to the suggested patch.)
 Pullup candidate.


 To generate a diff of this commit:
 cvs rdiff -u -r1.279.2.5 -r1.279.2.6 src/sys/kern/vfs_syscalls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Manuel Bouyer" <bouyer@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44648 CVS commit: [netbsd-4-0] src/sys/kern
Date: Sun, 20 Mar 2011 20:37:28 +0000

 Module Name:	src
 Committed By:	bouyer
 Date:		Sun Mar 20 20:37:27 UTC 2011

 Modified Files:
 	src/sys/kern [netbsd-4-0]: vfs_syscalls.c

 Log Message:
 Pull up following revision(s) (requested by dholland in ticket #1417):
 	sys/kern/vfs_syscalls.c: revision 1.415 via patch
 Check for bogus flags to access() up front. Otherwise we end up
 calling VOP_ACCESS with flags 0 and something asserts deep in the
 bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
 earlier relative to the suggested patch.)
 Pullup candidate.


 To generate a diff of this commit:
 cvs rdiff -u -r1.279.2.5 -r1.279.2.5.6.1 src/sys/kern/vfs_syscalls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Manuel Bouyer" <bouyer@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44648 CVS commit: [netbsd-5] src/sys/kern
Date: Sun, 20 Mar 2011 21:19:57 +0000

 Module Name:	src
 Committed By:	bouyer
 Date:		Sun Mar 20 21:19:57 UTC 2011

 Modified Files:
 	src/sys/kern [netbsd-5]: vfs_syscalls.c

 Log Message:
 Pull up following revision(s) (requested by dholland in ticket #1567):
 	sys/kern/vfs_syscalls.c: revision 1.415 via patch
 Check for bogus flags to access() up front. Otherwise we end up
 calling VOP_ACCESS with flags 0 and something asserts deep in the
 bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
 earlier relative to the suggested patch.)
 Pullup candidate.


 To generate a diff of this commit:
 cvs rdiff -u -r1.376.4.5 -r1.376.4.6 src/sys/kern/vfs_syscalls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Manuel Bouyer" <bouyer@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44648 CVS commit: [netbsd-5-0] src/sys/kern
Date: Sun, 20 Mar 2011 21:20:07 +0000

 Module Name:	src
 Committed By:	bouyer
 Date:		Sun Mar 20 21:20:06 UTC 2011

 Modified Files:
 	src/sys/kern [netbsd-5-0]: vfs_syscalls.c

 Log Message:
 Pull up following revision(s) (requested by dholland in ticket #1567):
 	sys/kern/vfs_syscalls.c: revision 1.415 via patch
 Check for bogus flags to access() up front. Otherwise we end up
 calling VOP_ACCESS with flags 0 and something asserts deep in the
 bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
 earlier relative to the suggested patch.)
 Pullup candidate.


 To generate a diff of this commit:
 cvs rdiff -u -r1.376.4.2.2.2 -r1.376.4.2.2.3 src/sys/kern/vfs_syscalls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Manuel Bouyer" <bouyer@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/44648 CVS commit: [netbsd-5-1] src/sys/kern
Date: Sun, 20 Mar 2011 21:20:13 +0000

 Module Name:	src
 Committed By:	bouyer
 Date:		Sun Mar 20 21:20:12 UTC 2011

 Modified Files:
 	src/sys/kern [netbsd-5-1]: vfs_syscalls.c

 Log Message:
 Pull up following revision(s) (requested by dholland in ticket #1567):
 	sys/kern/vfs_syscalls.c: revision 1.415 via patch
 Check for bogus flags to access() up front. Otherwise we end up
 calling VOP_ACCESS with flags 0 and something asserts deep in the
 bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
 earlier relative to the suggested patch.)
 Pullup candidate.


 To generate a diff of this commit:
 cvs rdiff -u -r1.376.4.5 -r1.376.4.5.2.1 src/sys/kern/vfs_syscalls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: pending-pullups->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Mon, 21 Mar 2011 02:08:23 +0000
State-Changed-Why:
Fixed.
(It was concluded after I filed the pullups that -5 can't be crashed,
so we don't need to write an advisory.)


>Unformatted:

Home	PR Database Search