#1625 assigned defect

TFTPFS memory corruption using relative paths

Reported by: Angus Gratton Owned by: Chris Johns
Priority: normal Milestone: 4.10.3
Component: fs Version: 4.10
Severity: normal Keywords:
Cc: sebastian.huber@… Blocked By:
Blocking:

Description (last modified by Gedare)

This is an issue I experienced when using 'chdir' and relative path access on TFTPFS in RTEMS 4.10.

Again, I was using a PowerPC MVME3100 but I think this is non-architecture-specific.

You may need to apply the patches submitted with Bug 1624 before you can get to this point at all (absolute path TFTPFS should be working as a prerequisite.)

To reproduce, use the attached test.c in place of network-demos/tftpTest/test.c and run the tftpTest program. You will see the initial absolute path accesses succeed, then the chdir & the first relative path access succeed, but the second relative path access will fail. You'll probably see a double-free error at this point.

The problem is that the pathloc->node_access pointer value is saved in the 'rtems_current_directory' struct, but it is also freed by the rtems_ftp_free_node_info() function. So the next TFTPFS access that uses a relative path will read unallocated memory.

I've attached a somewhat hacky patch that fixes this specific case, and helps to demonstrate the issue.

I don't think this is actually the "correct" way to fix the problem though, as it relies on each FS implementation explicitly checking if it is freeing the 'current_directory' copy of any pointers.

I think a better fix would be to implement a rtems_filesystem_dup_node_info() function for each filesystem, where the FS itself allocates new copies of any heap-allocated resources. Then the filesystem layer can call dup_node_info before writing the copy to the rtems_current_directory value, ensuring it has its own unique version of any heap-allocated resources.

I didn't have time to implement that though, sorry - need to get EPICS up and running!

Please let me know if you need me to explain anything better - the test app & patch should be more instructive than my vague rantings.

Attachments (4)

tftp-patch-2.diff (1.4 KB) - added by Angus Gratton on Jul 20, 2010 at 4:19:25 AM.
Demonstrative patch (hacky, see discussion)
test.c (3.0 KB) - added by Angus Gratton on Jul 20, 2010 at 4:20:11 AM.
Replacement network-demos/tftpTest/test.c to demonstrate issue
cwd-fix.diff (3.3 KB) - added by Angus Gratton on Nov 17, 2010 at 9:41:53 PM.
Better demonstrative patch (see comment)
issue1625_fix.patch (1.8 KB) - added by Angus Gratton on Oct 30, 2012 at 3:37:12 AM.
Fix against current 4.10 branch (tip c160bc2e97143df1015b4dc3107c133b9d9dc1d4)

Download all attachments as: .zip

Change History (10)

Changed on Jul 20, 2010 at 4:19:25 AM by Angus Gratton

Attachment: tftp-patch-2.diff added

Demonstrative patch (hacky, see discussion)

Changed on Jul 20, 2010 at 4:20:11 AM by Angus Gratton

Attachment: test.c added

Replacement network-demos/tftpTest/test.c to demonstrate issue

comment:1 Changed on Jul 20, 2010 at 11:43:46 PM by Chris Johns

dependson: 1624
Status: newassigned

Changed on Nov 17, 2010 at 9:41:53 PM by Angus Gratton

Attachment: cwd-fix.diff added

Better demonstrative patch (see comment)

comment:2 Changed on Nov 17, 2010 at 9:41:53 PM by Angus Gratton

attachments.isobsolete: 01

Changed on Oct 30, 2012 at 3:37:12 AM by Angus Gratton

Attachment: issue1625_fix.patch added

Fix against current 4.10 branch (tip c160bc2e97143df1015b4dc3107c133b9d9dc1d4)

comment:3 Changed on Oct 30, 2012 at 3:37:12 AM by Angus Gratton

attachments.isobsolete: 01

comment:4 Changed on Dec 6, 2012 at 8:00:56 AM by Sebastian Huber

Cc: Sebastian Huber added

Replying to comment:4:

Created attachment 1489 [details]
Fix against current 4.10 branch (tip c160bc2e97143df1015b4dc3107c133b9d9dc1d4)

How does the change in chdir() affect other file systems?

comment:5 Changed on Dec 6, 2012 at 8:02:10 AM by Sebastian Huber

Milestone: 4.114.10

comment:6 Changed on Nov 22, 2014 at 1:53:15 PM by Gedare

Description: modified (diff)
Milestone: 4.104.10.3
Note: See TracTickets for help on using tickets.