lkml.org 
[lkml]   [2017]   [Nov]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] proc: fix /proc/*/map_files lookup
On Tue, 21 Nov 2017 00:27:06 +0300 Alexey Dobriyan <adobriyan@gmail.com> wrote:

> Current code does:
>
> if (sscanf(dentry->d_name.name, "%lx-%lx", start, end) != 2)
>
> However sscanf() is broken garbage.
>
> It silently accepts whitespace between format specifiers
> (did you know that?).
>
> It silently accepts valid strings which result in integer overflow.
>
> Do not use sscanf() for any even remotely reliable parsing code.
>
> OK
> # readlink '/proc/1/map_files/55a23af39000-55a23b05b000'
> /lib/systemd/systemd
>
> broken
> # readlink '/proc/1/map_files/ 55a23af39000-55a23b05b000'
> /lib/systemd/systemd
>
> broken
> # readlink '/proc/1/map_files/55a23af39000-55a23b05b000 '
> /lib/systemd/systemd
>
> very broken
> # readlink '/proc/1/map_files/1000000000000000055a23af39000-55a23b05b000'
> /lib/systemd/systemd
>
> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
> Cc: stable@kernel.org

OK, but why is this a problem worthy of backporting into -stable kernels?

\
 
 \ /
  Last update: 2017-11-20 23:17    [W:0.082 / U:0.684 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site