[Midnightbsd-cvs] [MidnightBSD/src] 15e953: hastd: Fix crash on empty message

Thread index · Date index · Mailing lists

From: Lucas Holt <noreply_at_github.com>
Date: Wed, 14 Oct 2026 22:36:41 UTC

  Branch: refs/heads/master\n  Home:   https://github.com/MidnightBSD/src\n  Commit: 15e953209710986cb7a8c731c5e77803cb77b0c2\n      https://github.com/MidnightBSD/src/commit/15e953209710986cb7a8c731c5e77803cb77b0c2\n  Author: Glen Barber <gjb@FreeBSD.org>\n  Date:   2026-10-14 (Wed, 14 Oct 2026)\n\n  Changed paths:\n    M sbin/hastd/hast_proto.c\n\n  Log Message:\n  -----------\n  hastd: Fix crash on empty message\n\nA HAST message can be empty, in which case ebuf_add_tail() does nothing\nand ebuf_data() returns NULL because the size of the ebuf is zero, but\nhast_proto_recv_hdr() asserts that the return value is not NULL,\nresulting in an immediate crash if hastctl or hastd receive an empty\nmessage.  This is trivially reproducable by running `hastctl status` or\n`hastctl role init` (as the rc script does prior to stopping hastd).\n\nTo avoid this, don't try to grow the ebuf or receive additional data\nif the header size is zero.\n\nPR:\t\t298085\nMFC after:\t3 days\nReviewed by:\tkevans, gjb\nDifferential Revision:\thttps://reviews.freebsd.org/D59306\n\n(cherry picked from commit 8646d65b45339642d4aab1de35a2bc79fc45f09e)\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\n  Commit: c80f259a1f8f2e694925f222aa5d6c0fbd8acce0\n      https://github.com/MidnightBSD/src/commit/c80f259a1f8f2e694925f222aa5d6c0fbd8acce0\n  Author: Dag-Erling Smørgrav <des@FreeBSD.org>\n  Date:   2026-10-14 (Wed, 14 Oct 2026)\n\n  Changed paths:\n    M sbin/hastd/nv.c\n\n  Log Message:\n  -----------\n  hastd: Ensure nvpair padding is initialized\n\nThe proto-libnv implementation embedded in hastd pads names and values\nout to the nearest multiple of eight bytes, but leaves the padding\nuninitialized, leaking up to 14 bytes of recycled heap per pair in a\nmessage.\n\nWhile here, switch from bcopy() to memcpy().\n\nMFC after:\t3 days\nReviewed by:\tkevans, emaste\nDifferential Revision:\thttps://reviews.freebsd.org/D59343\n\n(cherry picked from commit 911bda7cffbf358c4e83ea05cfe980d429aff61c)\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\n  Commit: 6dd28da2402ca0eb7462a69685c43d6cbcac1a6c\n      https://github.com/MidnightBSD/src/commit/6dd28da2402ca0eb7462a69685c43d6cbcac1a6c\n  Author: Dag-Erling Smørgrav <des@FreeBSD.org>\n  Date:   2026-10-14 (Wed, 14 Oct 2026)\n\n  Changed paths:\n    M sbin/hastd/proto.c\n    M sbin/hastd/proto_impl.h\n    M sbin/hastd/proto_socketpair.c\n\n  Log Message:\n  -----------\n  hastd: Use fixed-length protocol names\n\nAll communication between hastd nodes and internally between hastd and\nits worker children passes through the same pair of send / receive\nfunctions.  The receive function uses recv(2) with the MSG_WAITALL flag,\nwhich in theory means we should never get a short read.  However, when\nhanding off a socket to a worker child, we also pass a variable-length\nstring identifying the type of socket we're passing, and reading this\nstring relies on a short read.  This used to work because the arrival of\nthe descriptor would interrupt the recv(2) call, but this bug was fixed\nwhen the AF_UNIX code was rewritten a while ago and hastd has been\nbroken ever since.\n\nFixing the length of the protocol name to four characters including the\nterminating null solves the short-read bug by never requiring a short\nread (nothing else in hastd requires one).\n\nNote that this issue appears to have been reported independently first\nby Alessandro Sagratini in PR 292322 and then by Martin Vidovic in\nD57511.  I ended up going in a different direction than Martin's patch,\nbut his analysis was invaluable, hence the double credit below.\n\nPR:\t\t292322\nReported by:\tMartin Vidovic <xtronom@gmail.com>\nMFC after:\t1 week\nEvent:\t\tEuroBSDcon DevSummit 2026\nReviewed by:\txtronom_gmail.com, kevans, glebius, gjb\nDifferential Revision:\thttps://reviews.freebsd.org/D59521\n\n(cherry picked from commit b7e5c2e008f5b441611830ad3a0329de0882419e)\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\n  Commit: b4f588b315ad9567c85463348f1078085f73cb79\n      https://github.com/MidnightBSD/src/commit/b4f588b315ad9567c85463348f1078085f73cb79\n  Author: Lucas Holt <luke@foolishgames.com>\n  Date:   2026-10-14 (Wed, 14 Oct 2026)\n\n  Changed paths:\n    M UPDATING\n\n  Log Message:\n  -----------\n  UPDATING: hastd EN-26:26\n\nRecord the hastd(8) fixes from FreeBSD-EN-26:26.hastd.\n\nAI-Assisted-by: Claude Opus 5.5\nSigned-off-by: Lucas Holt <luke@foolishgames.com>\n\n\nCompare: https://github.com/MidnightBSD/src/compare/ee40c0846016...b4f588b315ad\n\nTo unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications\n\n\nMidnightbsd-cvs\nmidnightbsd-cvs@midnightbsd.org\nTo unsubscribe: midnightbsd-cvs+unsubscribe@midnightbsd.org\nhttps://lists.midnightbsd.org/\n