From a8ee9e72eeb3545058c25dd4ecf355aecf4489c4 Mon Sep 17 00:00:00 2001 From: 4lDO2 <4lDO2@protonmail.com> Date: Thu, 10 Apr 2025 15:34:33 +0200 Subject: [PATCH] Fix possible TCB.thread_fd() use-after-free. --- redox-rt/src/thread.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/redox-rt/src/thread.rs b/redox-rt/src/thread.rs index 5d0c258e7d..953fce5e62 100644 --- a/redox-rt/src/thread.rs +++ b/redox-rt/src/thread.rs @@ -56,16 +56,16 @@ pub unsafe fn exit_this_thread(stack_base: *mut (), stack_size: usize) -> ! { let _guard = tmp_disable_signals(); let tcb = RtTcb::current(); - let thread_fd = tcb.thread_fd(); + // TODO: modify interface so it writes directly to the thread fd? + let status_fd = syscall::dup(**tcb.thread_fd(), b"status").unwrap(); let _ = syscall::funmap(tcb as *const RtTcb as usize, syscall::PAGE_SIZE); - // TODO: modify interface so it writes directly to the thread fd? - let status_fd = syscall::dup(**thread_fd, b"status").unwrap(); let mut buf = [0; size_of::() * 3]; plain::slice_from_mut_bytes(&mut buf) .unwrap() .copy_from_slice(&[usize::MAX, stack_base as usize, stack_size]); + // TODO: SYS_CALL w/CONSUME syscall::write(status_fd, &buf).unwrap(); unreachable!() }