Re:

--000000000000e25cb406575d0bd5
Content-Type: multipart/alternative; boundary="000000000000e25cb306575d0bd3"

--000000000000e25cb306575d0bd3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

ipc: Harden ipc_mqueue_send against null pointers, OOM, and race conditions

I have written a patch for the `ipc_mqueue_send` implementation in GNU Mach
(ipc/ipc_mqueue.c) that makes it safer against potential null pointer
accesses, allocation limit exhaustion under heavy message loads, and race
conditions on multi-core systems. You can already see the fixes for the
vulnerabilities that caught my attention whilst reading the code in the
patch.

Thanks,
Alperen

On Fri, Jul 24, 2026 at 4:39=E2=80=AFPM Alperen Erkan <erkanalperen54@gmail=
.com>
wrote:

>
> Thank you for the guidance and review!
>
> I have attached the clean patch file (0001-ipc_kmsg-fixes.patch) directly
> to this email to prevent any whitespace or formatting issues. It contains
> only the IPC memory fix and bounds checks.
>
> Regarding the documentation and communication: Understood. I will
> translate my technical notes into English and discuss all future findings
> directly here on [email protected]
>
> Forwarding the patch to the bug-hurd mailing list for review and public
> discussion.
>
> Best regards,
> Alperen Erkan
>

--000000000000e25cb306575d0bd3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div>ipc: Harden ipc_mqueue_send against null pointer=
s, OOM, and race conditions<br><br>I have written a patch for the `ipc_mque=
ue_send` implementation in GNU Mach (ipc/ipc_mqueue.c) that makes it safer =
against potential null pointer accesses, allocation limit exhaustion under =
heavy message loads, and race conditions on multi-core systems. You can alr=
eady see the fixes for the vulnerabilities that caught my attention whilst =
reading the code in the patch.<br><br></div>Thanks,<br></div>Alperen</div><=
br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" class=
=3D"gmail_attr">On Fri, Jul 24, 2026 at 4:39=E2=80=AFPM Alperen Erkan &lt;<=
a href=3D"mailto:[email protected]">[email protected]</a>&gt;=
 wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px =
0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr"><div><br>Thank you for the guidance and review!<br><br>I have atta=
ched the=20
clean patch file (0001-ipc_kmsg-fixes.patch) directly to this email to=20
prevent any whitespace or formatting issues. It contains only the IPC=20
memory fix and bounds checks.<br><br>Regarding the documentation and=20
communication: Understood. I will translate my technical notes into=20
English and discuss all future findings directly here on <a href=3D"mailto:=
[email protected]" target=3D"_blank">[email protected]</a></div><div><br></di=
v><div>Forwarding the patch to the bug-hurd mailing list for review and pub=
lic discussion.</div><br>Best regards,<br>Alperen Erkan</div>
</blockquote></div>

--000000000000e25cb306575d0bd3--

--000000000000e25cb406575d0bd5
Content-Type: application/octet-stream; name="ipc_mqueue_fix.patch"
Content-Disposition: attachment; filename="ipc_mqueue_fix.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mrz3j4120>
X-Attachment-Id: f_mrz3j4120

ZGlmZiAtLWdpdCBhL2dudW1hY2gvaXBjL2lwY19tcXVldWUuYyBiL2dudW1hY2gvaXBjL2lwY19t
cXVldWUuYwppbmRleCBmNzcwYWZiLi44MzRlYjE2IDEwMDY0NAotLS0gYS9nbnVtYWNoL2lwYy9p
cGNfbXF1ZXVlLmMKKysrIGIvZ251bWFjaC9pcGMvaXBjX21xdWV1ZS5jCkBAIC0zLDcgKzMsNiBA
QAogICogQ29weXJpZ2h0IChjKSAxOTkxLDE5OTAsMTk4OSBDYXJuZWdpZSBNZWxsb24gVW5pdmVy
c2l0eS4KICAqIENvcHlyaWdodCAoYykgMTk5MywxOTk0IFRoZSBVbml2ZXJzaXR5IG9mIFV0YWgg
YW5kCiAgKiB0aGUgQ29tcHV0ZXIgU3lzdGVtcyBMYWJvcmF0b3J5IChDU0wpLgotICogQ29weXJp
Z2h0IChjKSAyMDI2IEFscGVyZW4gRVJLQU4gLSBTdHV4NiBUZWNobm9sb2d5CiAgKiBBbGwgcmln
aHRzIHJlc2VydmVkLgogICoKICAqIFBlcm1pc3Npb24gdG8gdXNlLCBjb3B5LCBtb2RpZnkgYW5k
IGRpc3RyaWJ1dGUgdGhpcyBzb2Z0d2FyZSBhbmQgaXRzCkBAIC0yOCwxMSArMjcsMTEgQEAKICAq
IHRoZSByaWdodHMgdG8gcmVkaXN0cmlidXRlIHRoZXNlIGNoYW5nZXMuCiAgKi8KIC8qCi0gKglG
aWxlOglpcGMvaXBjX21xdWV1ZS5jCi0gKglBdXRob3I6CVJpY2ggRHJhdmVzCi0gKglEYXRlOgky
MDI2IAorICogIEZpbGU6ICAgaXBjL2lwY19tcXVldWUuYworICogIEF1dGhvcjogUmljaCBEcmF2
ZXMgLyBBbHBlcmVuIEVSS0FOIAorICogIERhdGU6ICAgMjAyNiAKICAqCi0gKglGdW5jdGlvbnMg
dG8gbWFuaXB1bGF0ZSBJUEMgbWVzc2FnZSBxdWV1ZXMuCisgKiAgRnVuY3Rpb25zIHRvIG1hbmlw
dWxhdGUgSVBDIG1lc3NhZ2UgcXVldWVzLgogICovCiAKICNpbmNsdWRlIDxtYWNoL3BvcnQuaD4K
QEAgLTUyLDYgKzUxLDEwIEBACiAjaW5jbHVkZSA8aXBjL2lwY19zcGFjZS5oPgogI2luY2x1ZGUg
PGlwYy9pcGNfbWFyZXF1ZXN0Lmg+CiAKKy8qIAorICogQW4gYWJzb2x1dGUgbWVzc2FnZSBxdWV1
ZSB1cHBlciBsaW1pdCB0byBwcmV2ZW50IE9PTSBhbmQgbWVtb3J5IGV4aGF1c3Rpb24uCisgKi8K
KyNkZWZpbmUgSVBDX01RVUVVRV9IQVJEX0xJTUlUIDY1NTM2CiAKIAogLyoKQEAgLTE1Niw2ICsx
NTksOCBAQCBpcGNfbXF1ZXVlX2NoYW5nZWQoCiAKIC8qCiAgKglSb3V0aW5lOglpcGNfbXF1ZXVl
X3NlbmQKKyAqICBBdXRob3IgOiAgICBBbHBlcmVuIEVSS0FOIAorICogCQkJCQkJIDIwMjYKICAq
CVB1cnBvc2U6CiAgKgkJU2VuZCBhIG1lc3NhZ2UgdG8gYSBwb3J0LiAgVGhlIG1lc3NhZ2UgaG9s
ZHMgYSByZWZlcmVuY2UKICAqCQlmb3IgdGhlIGRlc3RpbmF0aW9uIHBvcnQgaW4gdGhlIG1zZ2hf
cmVtb3RlX3BvcnQgZmllbGQuCkBAIC0xODAsOCArMTg1LDE2IEBAIGlwY19tcXVldWVfc2VuZCgK
IHsKIAlpcGNfcG9ydF90IHBvcnQ7CiAKKwkvKiBEZWZlbnNpdmUgQzogQ2hlY2tpbmcgdGhlIGlu
Y29taW5nIG1lc3NhZ2Ugb2JqZWN0IGFuZCBkZXN0aW5hdGlvbiBwb3J0ICovCisJaWYgKGttc2cg
PT0gSUtNX05VTEwpIHsKKyAgICAJcmV0dXJuIE1BQ0hfU0VORF9JTlZBTElEX0RBVEE7CisJfQor
CiAJcG9ydCA9IChpcGNfcG9ydF90KSBrbXNnLT5pa21faGVhZGVyLm1zZ2hfcmVtb3RlX3BvcnQ7
Ci0JYXNzZXJ0KElQX1ZBTElEKHBvcnQpKTsKKworCWlmICghSVBfVkFMSUQocG9ydCkpIHsKKyAg
IAkgICByZXR1cm4gTUFDSF9TRU5EX0lOVkFMSURfREVTVDsKKwl9CiAKIAlpcF9sb2NrKHBvcnQp
OwogCkBAIC0yMzAsMTcgKzI0MywxNyBAQCBpcGNfbXF1ZXVlX3NlbmQoCiAJCX0KIAogCQkvKgot
CQkgKiAgRG9uJ3QgYmxvY2sgaWY6Ci0JCSAqCTEpIFdlJ3JlIHVuZGVyIHRoZSBxdWV1ZSBsaW1p
dC4KLQkJICoJMikgQ2FsbGVyIHVzZWQgdGhlIE1BQ0hfU0VORF9BTFdBWVMgaW50ZXJuYWwgb3B0
aW9uLgotCQkgKgkzKSBNZXNzYWdlIGlzIHNlbnQgdG8gYSBzZW5kLW9uY2UgcmlnaHQuCi0JCSAq
LwotCi0JCWlmICgocG9ydC0+aXBfbXNnY291bnQgPCBwb3J0LT5pcF9xbGltaXQpIHx8Ci0JCSAg
ICAob3B0aW9uICYgTUFDSF9TRU5EX0FMV0FZUykgfHwKLQkJICAgIChNQUNIX01TR0hfQklUU19S
RU1PVEUoa21zZy0+aWttX2hlYWRlci5tc2doX2JpdHMpID09Ci0JCQkJCQlNQUNIX01TR19UWVBF
X1BPUlRfU0VORF9PTkNFKSkKLQkJCWJyZWFrOworICAgICAgICAgKiAgRG9uJ3QgYmxvY2sgaWY6
CisgICAgICAgICAqICAxKSBXZSdyZSB1bmRlciB0aGUgcXVldWUgbGltaXQuCisgICAgICAgICAq
ICAyKSBDYWxsZXIgdXNlZCBNQUNIX1NFTkRfQUxXQVlTIGJ1dCB3ZSBhcmUgdW5kZXIgdGhlIGhh
cmQgc2FmZXR5IGxpbWl0LgorICAgICAgICAgKiAgMykgTWVzc2FnZSBpcyBzZW50IHRvIGEgc2Vu
ZC1vbmNlIHJpZ2h0LgorICAgICAgICAgKi8KKworICAgICAgICBpZiAoKHBvcnQtPmlwX21zZ2Nv
dW50IDwgcG9ydC0+aXBfcWxpbWl0KSB8fAorICAgICAgICAgICAgKChvcHRpb24gJiBNQUNIX1NF
TkRfQUxXQVlTKSAmJiAocG9ydC0+aXBfbXNnY291bnQgPCBJUENfTVFVRVVFX0hBUkRfTElNSVQp
KSB8fAorICAgICAgICAgICAgKE1BQ0hfTVNHSF9CSVRTX1JFTU9URShrbXNnLT5pa21faGVhZGVy
Lm1zZ2hfYml0cykgPT0KKyAgICAgICAgICAgICAgICAgICAgICAgIE1BQ0hfTVNHX1RZUEVfUE9S
VF9TRU5EX09OQ0UpKQorICAgICAgICAgICAgYnJlYWs7CiAKIAkJLyogbXVzdCBibG9jayB3YWl0
aW5nIGZvciBxdWV1ZSB0byBjbGVhciAqLwogCkBAIC0yNjMsNDUgKzI3Niw0OSBAQCBpcGNfbXF1
ZXVlX3NlbmQoCiAJCWNvdW50ZXIoY19pcGNfbXF1ZXVlX3NlbmRfYmxvY2srKyk7CiAJCXRocmVh
ZF9ibG9jayh0aHJlYWRfbm9fY29udGludWF0aW9uKTsKIAkJaXBfbG9jayhwb3J0KTsKLQorICAK
IAkJLyogd2h5IGRpZCB3ZSB3YWtlIHVwPyAqLwogCi0JCWlmIChzZWxmLT5pdGhfc3RhdGUgPT0g
TUFDSF9NU0dfU1VDQ0VTUykKLQkJCWNvbnRpbnVlOwotCQlhc3NlcnQoc2VsZi0+aXRoX3N0YXRl
ID09IE1BQ0hfU0VORF9JTl9QUk9HUkVTUyk7CisgICAgICAgIGlmIChzZWxmLT5pdGhfc3RhdGUg
PT0gTUFDSF9NU0dfU1VDQ0VTUykgeworICAgICAgICAgICAgc2VsZi0+aXRoX3N0YXRlID0gTUFD
SF9NU0dfU1VDQ0VTUzsgLy8gdmV5YSB0ZW1peiBkdXJ1bSBzxLFmxLFybGFtYXPEsQorICAgICAg
ICAgICAgY29udGludWU7CisgICAgICAgIH0KKyAgICAgICAgYXNzZXJ0KHNlbGYtPml0aF9zdGF0
ZSA9PSBNQUNIX1NFTkRfSU5fUFJPR1JFU1MpOwogCi0JCS8qIHRha2Ugb3Vyc2VsdmVzIG9mZiBi
bG9ja2VkIHF1ZXVlICovCisgICAgICAgIC8qIHRha2Ugb3Vyc2VsdmVzIG9mZiBibG9ja2VkIHF1
ZXVlIHVuZGVyIHBvcnQgbG9jayAqLworICAgICAgICBpcGNfdGhyZWFkX3JtcXVldWUoJnBvcnQt
PmlwX2Jsb2NrZWQsIHNlbGYpOworICAgICAgICAKKyAgICAgICAgLyogW0RFRkVOU0lWRV06IENs
ZWFyIHN0YXRlIHRvIHByZXZlbnQgc3RhbGUgc3RhdHVzIHJldXNlICovCisgICAgICAgIHNlbGYt
Pml0aF9zdGF0ZSA9IE1BQ0hfTVNHX1NVQ0NFU1M7CiAKLQkJaXBjX3RocmVhZF9ybXF1ZXVlKCZw
b3J0LT5pcF9ibG9ja2VkLCBzZWxmKTsKKyAgICAgICAgLyoKKyAgICAgICAgICogIFRocmVhZCB3
YWtldXAtcmVhc29uIGZpZWxkIHRlbGxzIHVzIHdoeQorICAgICAgICAgKiAgdGhlIHdhaXQgd2Fz
IGludGVycnVwdGVkLgorICAgICAgICAgKi8KIAotCQkvKgotCQkgKglUaHJlYWQgd2FrZXVwLXJl
YXNvbiBmaWVsZCB0ZWxscyB1cyB3aHkKLQkJICoJdGhlIHdhaXQgd2FzIGludGVycnVwdGVkLgot
CQkgKi8KKyAgICAgICAgc3dpdGNoIChzZWxmLT5pdGhfd2FpdF9yZXN1bHQpIHsKKyAgICAgICAg
ICAgIGNhc2UgVEhSRUFEX0lOVEVSUlVQVEVEOgorICAgICAgICAgICAgLyogc2VuZCB3YXMgaW50
ZXJydXB0ZWQgLSBnaXZlIHVwICovCiAKLQkJc3dpdGNoIChzZWxmLT5pdGhfd2FpdF9yZXN1bHQp
IHsKLQkJICAgIGNhc2UgVEhSRUFEX0lOVEVSUlVQVEVEOgotCQkJLyogc2VuZCB3YXMgaW50ZXJy
dXB0ZWQgLSBnaXZlIHVwICovCisgICAgICAgICAgICBpcF91bmxvY2socG9ydCk7CisgICAgICAg
ICAgICByZXR1cm4gTUFDSF9TRU5EX0lOVEVSUlVQVEVEOwogCi0JCQlpcF91bmxvY2socG9ydCk7
Ci0JCQlyZXR1cm4gTUFDSF9TRU5EX0lOVEVSUlVQVEVEOworICAgICAgICAgICAgY2FzZSBUSFJF
QURfVElNRURfT1VUOgorICAgICAgICAgICAgLyogdGltZW91dCBleHBpcmVkICovCiAKLQkJICAg
IGNhc2UgVEhSRUFEX1RJTUVEX09VVDoKLQkJCS8qIHRpbWVvdXQgZXhwaXJlZCAqLwotCi0JCQlh
c3NlcnQob3B0aW9uICYgTUFDSF9TRU5EX1RJTUVPVVQpOwotCQkJdGltZV9vdXQgPSAwOwotCQkJ
YnJlYWs7CisgICAgICAgICAgICBhc3NlcnQob3B0aW9uICYgTUFDSF9TRU5EX1RJTUVPVVQpOwor
ICAgICAgICAgICAgdGltZV9vdXQgPSAwOworICAgICAgICAgICAgYnJlYWs7CiAKLQkJICAgIGNh
c2UgVEhSRUFEX1JFU1RBUlQ6Ci0JCSAgICBkZWZhdWx0OgorICAgICAgICAgICAgY2FzZSBUSFJF
QURfUkVTVEFSVDoKKyAgICAgICAgICAgIGRlZmF1bHQ6CiAjaWYgTUFDSF9BU1NFUlQKLQkJCWFz
c2VydCghImlwY19tcXVldWVfc2VuZCIpOworICAgICAgICAgICAgYXNzZXJ0KCEiaXBjX21xdWV1
ZV9zZW5kOiB1bmV4cGVjdGVkIHRocmVhZCB3YWtldXAgcmVzdWx0Iik7CiAjZWxzZQotCQkJcGFu
aWMoImlwY19tcXVldWVfc2VuZCIpOworICAgICAgICAgICAgcGFuaWMoImlwY19tcXVldWVfc2Vu
ZCIpOwogI2VuZGlmCi0JCX0KLQl9CisgICAgICAgIH0KKyAgICB9CiAKIAlpZiAoa21zZy0+aWtt
X2hlYWRlci5tc2doX2JpdHMgJiBNQUNIX01TR0hfQklUU19DSVJDVUxBUikgewogCQlpcF91bmxv
Y2socG9ydCk7Cg==
--000000000000e25cb406575d0bd5--