search

nanvix / kernel

Research Operating System Kernel
https://github.com/nanvix
MIT License
53 stars 8 forks source link

[pm] Mailbox `open` array on overflow #403

Closed rafael0121 closed 2 months ago

rafael0121 commented 7 months ago

Description

The array open in file omailboxes.c, is indexed using the process PID directly as position. So if the system create a PROCESS_MAX + 1, and this process try use mailbox, it will access a invalid memory address.

Code Snippet

Process intializer PID assignment

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/pm/process.c#L164

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/pm/process.c#L178-L179

Mailbox bug tracked

Declaration array open

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/ipc/mailbox/omailboxes.c#L64-L66

Function - omailboxes_alloc

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/ipc/mailbox/omailboxes.c#L82-L90

Function - omailboxes_lookup

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/ipc/mailbox/omailboxes.c#L112

Function - omailboxes_get

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/ipc/mailbox/omailboxes.c#L125

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/ipc/mailbox/omailboxes.c#L130

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/ipc/mailbox/omailboxes.c#L135

Function - omailboxes_release

https://github.com/nanvix/microkernel/blob/5f80f948549cb3317ddb04fd92d4554c4b2a9aae/src/kernel/ipc/mailbox/omailboxes.c#L196