[Xenomai-core] proc_file_read: Apparent buffer overflow

[Xenomai-core] proc_file_read: Apparent buffer overflow

[Stefan Kisdaroczi]

[-- Attachment #1: Type: text/plain, Size: 379 bytes --]

Hi,

cat /proc/xenomai/heap returns the first 4096 Bytes and fails then with "Bad address".
On the console I see: "proc_file_read: Apparent buffer overflow!"

xeno 2.5.1, linux 2.6.32.8, x86 32bit UP, native skin, lot of rt_queues:
# ls -1 /proc/xenomai/registry/native/queues/ | wc -l
233
# ls -1 /proc/xenomai/registry/native/heaps/ | wc -l
26

regards
Stefan



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 251 bytes --]

Re: [Xenomai-core] proc_file_read: Apparent buffer overflow

[Stefan Kisdaroczi]

[-- Attachment #1: Type: text/plain, Size: 584 bytes --]

Am 10.03.2010 19:56, schrieb Stefan Kisdaroczi:
> Hi,
> 
> cat /proc/xenomai/heap returns the first 4096 Bytes and fails then with "Bad address".
> On the console I see: "proc_file_read: Apparent buffer overflow!"
> 
> xeno 2.5.1, linux 2.6.32.8, x86 32bit UP, native skin, lot of rt_queues:
> # ls -1 /proc/xenomai/registry/native/queues/ | wc -l
> 233
> # ls -1 /proc/xenomai/registry/native/heaps/ | wc -l
> 26

With some luck i get a oops doing cat /proc/xenomai/heap.
Looking at the while() loop in heap_read_proc() in ksrc/nucleus/heap.c
its obvious.

Stefan


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 251 bytes --]

Re: [Xenomai-core] proc_file_read: Apparent buffer overflow

[Jan Kiszka]

Stefan Kisdaroczi wrote:
> Am 10.03.2010 19:56, schrieb Stefan Kisdaroczi:
>> Hi,
>>
>> cat /proc/xenomai/heap returns the first 4096 Bytes and fails then with "Bad address".
>> On the console I see: "proc_file_read: Apparent buffer overflow!"
>>
>> xeno 2.5.1, linux 2.6.32.8, x86 32bit UP, native skin, lot of rt_queues:
>> # ls -1 /proc/xenomai/registry/native/queues/ | wc -l
>> 233
>> # ls -1 /proc/xenomai/registry/native/heaps/ | wc -l
>> 26
> 
> With some luck i get a oops doing cat /proc/xenomai/heap.
> Looking at the while() loop in heap_read_proc() in ksrc/nucleus/heap.c
> its obvious.

You mean because "count" isn't checked while the output page is filled?
Well, looks like converting the heap proc interface to the seq API is a
good idea. References can be found in ksrc/nucleus/sched.c, patches are
welcome. :)

Jan

-- 
Siemens AG, Corporate Technology, CT T DE IT 1
Corporate Competence Center Embedded Linux