lkml.org 
[lkml]   [2004]   [Mar]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectMysterious string truncation in 2.4.25 kernel
Aloha,

I'm running a patched 2.4.25 kernel and I noticed truncated strings in
various procfs files. e.g.

# cat /proc/tty/drivers
se /dev/cua/%d 5 64-127 serial:callout
se /dev/tts/%d 4 64-127 se
pty_slave /dev/pts/%d 136 0-255 pty:slave
pty_master /dev/ptm 128 0-255 pty:master
pty_slave /dev/pty/s%d 3 0-255 pty:slave
pty_master /dev/pty/m%d 2 0-255 pty:master
/dev/vc/0 /dev/vc/0 4 0 system:vtmaster
/dev/ptmx /dev/ptmx 5 2 system
/dev/console /dev/console 5 1 system:console
/dev/tty /dev/tty 5 0 system:/dev/tty
unknown /dev/vc/%d 4 1-63 console

Notice that "serial" is output as "se" in the top two lines.
I was able to produce similar results on a vanilla 2.4.25 kernel by
simply changing the length of a few strings in fs/proc/proc_tty.c.
I believe the problem is caused by the following patch:

ChangeSet@1.1290.1.16 2004-01-31 21:16:34-02:00 jmorris@redhat.com

> [PATCH] Zero last byte of mount option page
>
> Hi Al,
>
> Here's a patch which zeroes the last byte of the mount option data copied
> from userspace during mount(2).
>
> For filesystems which parse mount options as strings (the majority), lack
> of a zero terminator could cause the page to be overrun. The source code
> comments specify that the maximum size of the mount data is PAGE_SIZE-1,
> so this patch will not affect any valid binary-formatted mount data.

--- 1.24/fs/namespace.c Tue Mar 2 15:50:11 2004
+++ 1.25/fs/namespace.c Tue Mar 2 15:50:11 2004
@@ -715,6 +715,9 @@
if (dev_name && !memchr(dev_name, 0, PAGE_SIZE))
return -EINVAL;

+ if (data_page)
+ ((char *)data_page)[PAGE_SIZE - 1] = 0;
+
/* Separate the per-mountpoint flags */
if (flags & MS_NOSUID)
mnt_flags |= MNT_NOSUID;
Could someone please comment on the correctness of the above patch
especially regarding procfs?

- glen
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:01    [W:0.040 / U:0.184 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site