Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🚨possible UB on linux in all releases that use getmntent🚨 #42

Open
2 of 4 tasks
Byron opened this issue Jan 22, 2022 · 1 comment
Open
2 of 4 tasks

🚨possible UB on linux in all releases that use getmntent🚨 #42

Byron opened this issue Jan 22, 2022 · 1 comment

Comments

@Byron
Copy link
Owner

Byron commented Jan 22, 2022

See this PR for more information.

This issue can be used to figure out a way out of this without breakage, while reducing risk of this UB to be exploited at some point.

What we did so far

  • make multi-threaded usage on linux and freebsd safe by synchronizing the function call, knowing that this will reduce multi-threaded 'trashing' somewhat and be ineffective in case calls are made directly to libc::getmnt*() from other threads.
  • yank all v2.0 versions prior to v2.0.4 as they contained the use of getmntent()

How to fix Linux

This fix reduces chances of UB to zero and makes the Mutex unnecessary.

  • use getmntent_r() instead of getmntent()

How to fix FreeBSD

This fix reduces chances of UB to zero and makes the Mutex unnecessary.

  • Use getfsstat directly, which avoids the statically allocated buffers entirely. Thanks, @avitex, for the suggestion.

That's all we know.

@Byron Byron changed the title possible UB on linux in all releases that use getmntent 🚨possible UB on linux in all releases that use getmntent🚨 Jan 22, 2022
@avitex
Copy link

avitex commented Feb 13, 2022

For getmntinfo, you can just use getfsstat which is re-entrant. getmntinfo just wraps getfsstat internally.

Note that you're given ownership of the buffer with getfsstat, of which you could just smack into a OnceCell. For the case where a thread loses the race on init, you would have to call free on the buffer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants