4 ms·
Does the NetBSD kernel itself already ensure mutual exclusion of read and write functions on the same device? Otherwise, I see a use-after-free here. A read co
by raimue 9y ago
Does the NetBSD kernel itself already ensure mutual exclusion of read and write functions on the same device?
Otherwise, I see a use-after-free here. A read could occur right after the write function free'd the old buffer in sc.buf, but before assigning a new pointer value. The read function would be able to read kernel memory via the old buffer pointer, although the memory pages pointed to may already have been reused for something else.
If my assumption is correct, the solution would be to use a mutex object to make the read block while the write updates the buffer.
- monocasa 9y agoThe kernel grabs a mutex on the device before calling d_read or d_write. https://nxr.netbsd.org/xref/src/sys/kern/subr_devsw.c#905 https://nxr.netbsd.org/xref/src/sys/kern/subr_devsw.c#905
- raimue 9y agoThank you for clearing up my doubts. I appreciate the link to the relevant code section.