Thank you for the guidance and review! I have attached the clean patch file (0001-ipc_kmsg-fixes.patch) directly to this email to prevent any whitespace or formatting issues. It contains only the IPC memory fix and bounds checks.
Regarding the documentation and communication: Understood. I will translate my technical notes into English and discuss all future findings directly here on [email protected] Forwarding the patch to the bug-hurd mailing list for review and public discussion. Best regards, Alperen Erkan
From 621d0c946e16e0acdc99435040d72d6fe1516b6f Mon Sep 17 00:00:00 2001 From: Alperen ERKAN <[email protected]> Date: Fri, 24 Jul 2026 09:03:08 +0300 Subject: [PATCH] ipc_kmsg: Add NULL protection, bounds checks and overflow guards --- gnumach/ipc/ipc_kmsg.c | 45 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 43 insertions(+), 2 deletions(-) diff --git a/gnumach/ipc/ipc_kmsg.c b/gnumach/ipc/ipc_kmsg.c index 8ab0e2e..19a76f3 100644 --- a/gnumach/ipc/ipc_kmsg.c +++ b/gnumach/ipc/ipc_kmsg.c @@ -450,14 +450,21 @@ ipc_kmsg_clean_partial( void ipc_kmsg_free(ipc_kmsg_t kmsg) { - vm_size_t size = kmsg->ikm_size; + vm_size_t size; + + /* Early exit: NULL kmsg protection */ + if (unlikely(kmsg == IKM_NULL)) + return; + + size = kmsg->ikm_size; switch (size) { case IKM_SIZE_NETWORK: net_kmsg_put(kmsg); break; default: + if (unlikely(size == 0 || size > IKM_SAVED_MAX)) + return; kfree((vm_offset_t) kmsg, size); break; } } @@ -485,6 +492,11 @@ ipc_kmsg_get( if ((size < sizeof(mach_msg_user_header_t)) || mach_msg_user_is_misaligned(size)) return MACH_SEND_MSG_TOO_SMALL; + /* Bounds check & integer overflow protection */ + if (unlikely(size > IKM_SAVED_MAX || + size > (MACH_MSG_SIZE_MAX / IKM_EXPAND_FACTOR))) + return MACH_SEND_NO_BUFFER; + if (ksize <= IKM_SAVED_MSG_SIZE) { kmsg = ikm_cache_alloc(); if (kmsg == IKM_NULL) @@ -497,7 +509,7 @@ ipc_kmsg_get( } if (copyinmsg(msg, &kmsg->ikm_header, size, kmsg->ikm_size)) { - ikm_free(kmsg); + ipc_kmsg_free(kmsg); return MACH_SEND_INVALID_DATA; } -- 2.43.0
