This message generated a parse failure. Raw output follows here. Please use 'back' to navigate. From devnull@lkml.org Thu May 2 16:27:12 2024 Received: from entropy.muc.muohio.edu (entropy.muc.muohio.edu [134.53.213.10]) by herbie.ucs.indiana.edu (8.8.8/8.8.8) with ESMTP id HAA29201 for ; Fri, 11 Sep 1998 07:17:27 -0500 (EST) Received: from vger.rutgers.edu (root@vger.rutgers.edu [128.6.190.2]) by entropy.muc.muohio.edu (8.8.8/Not-Vulnerable) with ESMTP id IAA20241; Fri, 11 Sep 1998 08:16:39 -0400 Received: by vger.rutgers.edu id <154239-8316>; Fri, 11 Sep 1998 05:25:35 -0400 Received: from mail1.astra.co.uk ([195.224.154.250]:10338 "EHLO mail1.astra.co.uk" ident: "NO-IDENT-SERVICE[2]") by vger.rutgers.edu with ESMTP id <154162-8316>; Fri, 11 Sep 1998 05:25:08 -0400 Received: from io.stargate.co.uk (root@Line09.astra.co.uk [195.224.27.89]) by mail1.astra.co.uk (8.8.8/8.8.8) with ESMTP id MAA05854 for ; Fri, 11 Sep 1998 12:11:35 GMT Received: (from dps@localhost) by io.stargate.co.uk (8.8.8/8.7.3) id EAA02059 for linux-kernel@vger.rutgers.edu; Fri, 11 Sep 1998 04:15:01 +0100 Date: Fri, 11 Sep 1998 04:15:01 +0100 From: Duncan Simpson Message-Id: <199809110315.EAA02059@io.stargate.co.uk> To: linux-kernel@vger.rutgers.edu Subject: Serious devpts bug (still not fixed) X-Orcpt: rfc822;linux-kernel@vger.rutgers.edu Sender: owner-linux-kernel@vger.rutgers.edu Precedence: bulk X-Loop: majordomo@vger.rutgers.edu I tried to report this bug a while back but it is still at large. At the end of fs/devpts/root.c it says dentry->d_inode = sbi->inodes[entry]; if ( dentry->d_inode ) dentry->d_inode->i_count++; Sadly it only checks that the filename is all 0 to 9 and has no leading 0s. There is no check that entry is small enough to be a legimate index of the sbi->inodes[]. Since the default is 256 and most people go with that cat /dev/pts/666 is normal lethal. If you are unluckly dentry->d_inode contains some really lethal screwy data and the dentry->d_inode->i_count++ screws some important data structure somewhere. I changed by kernel to say if (entrymax_ptys) /* Check range of number */ { dentry->d_inode = sbi->inodes[entry]; if ( dentry->d_inode ) dentry->d_inode->i_count++; } instead so if entry is too big dentry stays NULL and the naughty memory reference does not happen. libpt-0.3, avialable by annoymous ftp from mars.astra.co.uk in the pub/word2x directory contains a demo/bug test program and diff to apply this fix the patches directory. Assuming you have gcc <2.8 is might also work too., [2~ (glibc 2.1.x is a loser, because it inists on gcc >2.8 or egcs >1.0.2 to avoid tickling bugs. This bug is not fixed in 2.1.121 (or anything else, probably). An altetnative patch says if (entry>=sbi->max_ptys) return 0; before using index as an array element number. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/faq.html