Messages in this thread | | | Date | Fri, 16 May 2008 00:22:14 +0400 | From | "Cyrill Gorcunov" <> | Subject | Re: [PATCH] init - fix building bug and potential buffer overflow |
| |
Could you please make an update to the patch? I can make it only tomorrow evening (ie not that fast)
On 5/15/08, Geert Uytterhoeven <geert@linux-m68k.org> wrote: > On Thu, 15 May 2008, Cyrill Gorcunov wrote: >> [Andrew Morton - Thu, May 15, 2008 at 10:58:03AM -0700] >> | On Wed, 14 May 2008 19:44:02 +0400 Cyrill Gorcunov <gorcunov@gmail.com> >> wrote: >> | >> | > This patch does fix build bug on m68k wich does not have strncat in >> straight way. >> | > >> | > What is more important - my previous patch >> | > >> | > commit e662e1cfd434aa234b72fbc781f1d70211cb785b >> | > Author: Cyrill Gorcunov <gorcunov@gmail.com> >> | > Date: Mon May 12 14:02:22 2008 -0700 >> | > >> | > init: don't lose initcall return values >> | > >> | > has introduced potential buffer overflow by wrong calculation >> | > of string accumulator size. >> | > >> | > Many thanks Andreas Schwab and Geert Uytterhoeven for helping >> | > to catch and fix the bug. >> | > >> | > Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com> >> | > --- >> | > >> | > Index: linux-2.6.git/init/main.c >> | > =================================================================== >> | > --- linux-2.6.git.orig/init/main.c 2008-05-14 17:55:10.000000000 +0400 >> | > +++ linux-2.6.git/init/main.c 2008-05-14 19:11:18.000000000 +0400 >> | > @@ -702,7 +702,7 @@ static void __init do_initcalls(void) >> | > >> | > for (call = __initcall_start; call < __initcall_end; call++) { >> | > ktime_t t0, t1, delta; >> | > - char msgbuf[40]; >> | > + char msgbuf[64]; >> | > int result; >> | > >> | > if (initcall_debug) { >> | > @@ -729,11 +729,11 @@ static void __init do_initcalls(void) >> | > sprintf(msgbuf, "error code %d ", result); >> | > >> | > if (preempt_count() != count) { >> | > - strncat(msgbuf, "preemption imbalance ", sizeof(msgbuf)); >> | > + strcat(msgbuf, "preemption imbalance "); >> | > preempt_count() = count; >> | > } >> | > if (irqs_disabled()) { >> | > - strncat(msgbuf, "disabled interrupts ", sizeof(msgbuf)); >> | > + strcat(msgbuf, "disabled interrupts "); >> | > local_irq_enable(); >> | > } >> | > if (msgbuf[0]) { >> | >> | umm, why can't m68k call strncat() from init/main.c?? >> | >> >> there some problem with headers iirc, we have to declare it first or >> use some gcc option (as Adrian suggested). Actually I would prefer to use > > gcc turns the strncat() into an implicit call to strlen() and some form > of expanded memcpy(). E.g. > > > if (preempt_count() != count) { > strncat(msgbuf, "preemption imbalance ", sizeof(msgbuf)); > preempt_count() = count; > } > > becomes > > cmp.l 884(%a2),%d6 | <variable>.thread.info.preempt_count, > count > jeq .L61 | > move.l %d7,-(%sp) | tmp76, > jbsr strlen | > addq.l #4,%sp |, > move.l %d7,%a0 | tmp76, tmp80 > add.l %d0,%a0 |, tmp80 > move.l #1886545253,(%a0)+ |, > move.l #1836086377,(%a0)+ |, > move.l #1869488233,(%a0)+ |, > move.l #1835164012,(%a0)+ |, > move.l #1634624357,(%a0)+ |, > move.w #8192,(%a0) |,* D.28541 > move.l %d6,884(%a2) | count, > <variable>.thread.info.preempt_count > .L61: > > All other explicit calls to strlen() are inlined, as per > include/asm-m68k/string.h. > >> strlcat there but it seems it would fail to build too. Originally I've >> messed >> strlcat with strncat :( > > Actually it build and runs fine after s/strncat/strlcat/... > > Gr{oetje,eeting}s, > > Geert > > -- > Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- > geert@linux-m68k.org > > In personal conversations with technical people, I call myself a hacker. But > when I'm talking to journalists I just say "programmer" or something like > that. > -- Linus Torvalds >
| |