Repository navigation
fix(libkernel): pipe crashes on a descriptor array in unmapped memory instead of failing with EFAULT and closing the new descriptors #10977
Description
pipe_nid_postfix (core/libs/prx/libkernel/File/src/Stdio.cpp) writes the two descriptors with memcpy after no real check: GuestArena::HostWrite::Open() accepts any non-arena host pointer. A pointer into unmapped memory (1, 0xfffffffffffff000) crashes the host. FreeBSD 11.4 sys_pipe2 copies the descriptors out after kern_pipe and, if that fails, closes both and returns EFAULT (sys/kern/sys_pipe.c:479-483).
getsockname and getpeername have the same problem with their address and length pointers but live in Udp.cpp, which several open PRs touch, so they are left out.
AI-assisted (Claude Code).
Activity
MarcZX10 commentedon Oct 25, 2026
One coordination point for the eventual fix: open PR #10975 adds a checked
GuestCopyOut_nid_no_patchhelper, but it is not merged and currently only routes the time-related outputs through it. Thepipefix will need to use that helper only after it is available on its base (declareDepends on: #10975if the branch builds on it), or otherwise avoid introducing duplicate checked-copy behavior. Keep the failure cleanup from the FreeBSDpipe2path: if copying out either descriptor fails, close both newly created descriptors and return EFAULT.xXPBSXx commentedon Oct 25, 2026
Thanks.
GuestCopyOut_nid_no_patchis already onmain: it came with #9618 (83f28bd67f,core/libs/prx/libc/src/General.cpp), not with #10975. #10979 is based onmainand only calls it; it does not add or change the helper (its diff isStdio.cpp, the new test and the CMake entry), so it does not depend on #10975. The failure path closes both new descriptors and returns EFAULT, as insys_pipe2.AI-assisted (Claude Code).
MarcZX10 commentedon Oct 25, 2026
You're right; I missed that is already present on main from #9618. I checked the #10979 diff, and it only uses the existing helper, so no dependency on #10975 is needed. Thanks for correcting that.
MarcZX10 commentedon Oct 25, 2026
To be precise:
GuestCopyOut_nid_no_patchis already present onmainfrom #9618. I checked the #10979 diff, and it only uses that existing helper, so no dependency on #10975 is needed. Thanks for correcting my earlier comment.EternalCoderss commentedon Oct 26, 2026
MarcZX10 commentedon Oct 26, 2026
Open PR #10979 implements the reported invalid-descriptor-array handling and closes descriptors when copy-out fails. Its Windows/Linux focused test report is from an older main; the branch is now 769 commits behind current main, so I requested a refresh and exact-head rerun before treating the issue as resolved. The issue remains open until the fix lands.