From fa2893eab4048638cc250a3bccc304a9e1f69a72 Mon Sep 17 00:00:00 2001
From: Vladislav Shpilevoy <v.shpilevoy@tarantool.org>
Date: Wed, 6 Nov 2019 15:53:39 +0300
Subject: [PATCH] func: fix use after free on function unload
Functions are stored in lists inside module objects. Module
objects are stored in a hash table, where key is a package name.
But the key was a pointer at one of module's function definition
object. Therefore, when that function was deleted, its freed
package name memory was still in the hash key, and could be
accessed, when another function was deleted.
Now module does not use memory of its functions, and keep a copy
of the package name.
---
src/box/func.c | 25 ++++++++++++++-----------
src/box/func.h | 2 ++
2 files changed, 16 insertions(+), 11 deletions(-)
diff --git a/src/box/func.c b/src/box/func.c
index 7ac92bc847..d9481b714d 100644
--- a/src/box/func.c
+++ b/src/box/func.c
@@ -209,12 +209,12 @@ module_cache_find(const char *name, const char *name_end)
* Save module to the module cache.
*/
static inline int
-module_cache_put(const char *name, const char *name_end, struct module *module)
+module_cache_put(struct module *module)
{
- size_t name_len = name_end - name;
- uint32_t name_hash = mh_strn_hash(name, name_len);
+ size_t package_len = strlen(module->package);
+ uint32_t name_hash = mh_strn_hash(module->package, package_len);
const struct mh_strnptr_node_t strnode = {
- name, name_len, name_hash, module};
+ module->package, package_len, name_hash, module};
if (mh_strnptr_put(modules, &strnode, NULL, NULL) == mh_end(modules)) {
diag_set(OutOfMemory, sizeof(strnode), "malloc", "modules");
@@ -248,12 +248,16 @@ module_load(const char *package, const char *package_end)
if (module_find(package, package_end, path, sizeof(path)) != 0)
return NULL;
- struct module *module = (struct module *) malloc(sizeof(*module));
+ int package_len = package_end - package;
+ struct module *module = (struct module *)
+ malloc(sizeof(*module) + package_len + 1);
if (module == NULL) {
- diag_set(OutOfMemory, sizeof(struct module), "malloc",
- "struct module");
+ diag_set(OutOfMemory, sizeof(struct module) + package_len + 1,
+ "malloc", "struct module");
return NULL;
}
+ memcpy(module->package, package, package_len);
+ module->package[package_len] = 0;
rlist_create(&module->funcs);
module->calls = 0;
module->is_unloading = false;
@@ -264,7 +268,7 @@ module_load(const char *package, const char *package_end)
}
char load_name[PATH_MAX + 1];
snprintf(load_name, sizeof(load_name), "%s/%.*s." TARANTOOL_LIBEXT,
- dir_name, (int)(package_end - package), package);
+ dir_name, package_len, package);
if (symlink(path, load_name) < 0) {
diag_set(SystemError, "failed to create dso link");
goto error;
@@ -275,7 +279,6 @@ module_load(const char *package, const char *package_end)
if (rmdir(dir_name) != 0)
say_warn("failed to delete temporary dir %s", dir_name);
if (module->handle == NULL) {
- int package_len = (int) (package_end - package_end);
diag_set(ClientError, ER_LOAD_MODULE, package_len,
package, dlerror());
goto error;
@@ -346,7 +349,7 @@ module_reload(const char *package, const char *package_end, struct module **modu
rlist_move(&new_module->funcs, &func->item);
}
module_cache_del(package, package_end);
- if (module_cache_put(package, package_end, new_module) != 0)
+ if (module_cache_put(new_module) != 0)
goto restore;
old_module->is_unloading = true;
module_gc(old_module);
@@ -486,7 +489,7 @@ func_c_load(struct func_c *func)
module = module_load(name.package, name.package_end);
if (module == NULL)
return -1;
- if (module_cache_put(name.package, name.package_end, module)) {
+ if (module_cache_put(module)) {
module_delete(module);
return -1;
}
diff --git a/src/box/func.h b/src/box/func.h
index 2236fd873d..18b83faac3 100644
--- a/src/box/func.h
+++ b/src/box/func.h
@@ -56,6 +56,8 @@ struct module {
size_t calls;
/** True if module is being unloaded. */
bool is_unloading;
+ /** Module's package name. */
+ char package[0];
};
/** Virtual method table for func object. */
--
GitLab