Skip to content

multiboot2: fix memory issue in boxed_dst_tag #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 21, 2023
Merged

multiboot2: fix memory issue in boxed_dst_tag #152

merged 1 commit into from
Jun 21, 2023

Conversation

phip1611
Copy link
Member

@phip1611 phip1611 commented Jun 21, 2023

This fixes multiple memory issues (wrong allocation and wrong fat pointer creation) that were introduced in #133 with 544e1ca.

I found the issues by running miri.

@phip1611
Copy link
Member Author

phip1611 commented Jun 21, 2023

@YtvwlD There were two memory issues in your boxed_dst_tag function. Not blaming you, just FYI :)

@phip1611 phip1611 merged commit a72a674 into main Jun 21, 2023
@phip1611 phip1611 deleted the dev4 branch June 21, 2023 13:38
@YtvwlD
Copy link
Contributor

YtvwlD commented Jun 21, 2023

Interesting. What's the difference?

Are you sure rounding up works for packed structs?

@phip1611
Copy link
Member Author

phip1611 commented Jun 21, 2023

Interesting. What's the difference?

  1. Box::from_raw(ptr_meta::from_raw_parts_mut(ptr as *mut (), content.len()))
    By using content.len(), an error was introduced that may add more items to the slice than there are in content. Hence, access to possibly invalid memory.

    1. The value passed as size hint to ptr_meta::from_raw_parts_mut must be divided by the size of each item in the slice (see https://github.com/rust-osdev/multiboot2/blob/main/multiboot2/src/memory_map.rs#L70)
    2. It must be taken into account that for example for the ElfSectionsTag, content does contain more bytes than just for the dynamically sized slice part.

I totally confirm that it is confusing that the size hint is really just the amount of elements in the dynamically sized slice but not the struct itself.

  1. There were allocation problems: wrong allocation size and wrong allocation alignment

This one wasn't obvious and I only discovered so because miri told me.

Are you sure rounding up works for packed structs?

Very well question. Thanks for the pointer :) I'm not sure.. can you give me an example please where you think it might fail?

@YtvwlD
Copy link
Contributor

YtvwlD commented Jun 21, 2023

Ah, I think I caused that when moving the Box cast into the function instead of keeping in the news. (Because in a generic tag the content is just bytes.)

@phip1611
Copy link
Member Author

Yeah, I thought so. It's a minefield, could have happened to me as well :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants