lkml.org 
[lkml]   [2004]   [Mar]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectMysterious string truncation in 2.4.25 kernel
    Aloha,

    I'm running a patched 2.4.25 kernel and I noticed truncated strings in
    various procfs files. e.g.

    # cat /proc/tty/drivers
    se /dev/cua/%d 5 64-127 serial:callout
    se /dev/tts/%d 4 64-127 se
    pty_slave /dev/pts/%d 136 0-255 pty:slave
    pty_master /dev/ptm 128 0-255 pty:master
    pty_slave /dev/pty/s%d 3 0-255 pty:slave
    pty_master /dev/pty/m%d 2 0-255 pty:master
    /dev/vc/0 /dev/vc/0 4 0 system:vtmaster
    /dev/ptmx /dev/ptmx 5 2 system
    /dev/console /dev/console 5 1 system:console
    /dev/tty /dev/tty 5 0 system:/dev/tty
    unknown /dev/vc/%d 4 1-63 console

    Notice that "serial" is output as "se" in the top two lines.
    I was able to produce similar results on a vanilla 2.4.25 kernel by
    simply changing the length of a few strings in fs/proc/proc_tty.c.
    I believe the problem is caused by the following patch:

    ChangeSet@1.1290.1.16 2004-01-31 21:16:34-02:00 jmorris@redhat.com

    > [PATCH] Zero last byte of mount option page
    >
    > Hi Al,
    >
    > Here's a patch which zeroes the last byte of the mount option data copied
    > from userspace during mount(2).
    >
    > For filesystems which parse mount options as strings (the majority), lack
    > of a zero terminator could cause the page to be overrun. The source code
    > comments specify that the maximum size of the mount data is PAGE_SIZE-1,
    > so this patch will not affect any valid binary-formatted mount data.

    --- 1.24/fs/namespace.c Tue Mar 2 15:50:11 2004
    +++ 1.25/fs/namespace.c Tue Mar 2 15:50:11 2004
    @@ -715,6 +715,9 @@
    if (dev_name && !memchr(dev_name, 0, PAGE_SIZE))
    return -EINVAL;

    + if (data_page)
    + ((char *)data_page)[PAGE_SIZE - 1] = 0;
    +
    /* Separate the per-mountpoint flags */
    if (flags & MS_NOSUID)
    mnt_flags |= MNT_NOSUID;
    Could someone please comment on the correctness of the above patch
    especially regarding procfs?

    - glen
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 14:01    [W:0.023 / U:1.204 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site