[udev] bug in udev-remove.c

[udev] bug in udev-remove.c

[Kay Sievers]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]


Uups, we have a bug in udev-remove.c.

udev segfaults with NULL-pointer, if the device is not in the database:

  ./test.block: line 29:  4844 Segmentation fault      $BIN block
  Dec 17 22:47:42 pim udev[4882]: udev_remove_device: '/block/sdy' not found in database, falling back on default name
  Dec 17 22:47:42 pim udev[4882]: udev_remove_device: name is '(null)'


thanks,
Kay



[-- Attachment #2: 01-bug-in-remove.diff --]
[-- Type: text/plain, Size: 731 bytes --]

--- ../udev/udev-remove.c	2003-12-10 03:40:14.000000000 +0100
+++ udev-remove.c	2003-12-17 22:45:09.000000000 +0100
@@ -118,8 +118,8 @@
  */
 int udev_remove_device(char *path, char *subsystem)
 {
-	char name[100];
 	struct udevice *dev;
+	struct udevice device;
 	char *temp;
 
 	dev = udevdb_get_dev(path);
@@ -128,13 +128,15 @@
 		temp = strrchr(path, '/');
 		if (temp == NULL)
 			return -ENODEV;
-		strncpy(name, &temp[1], sizeof(name));
+		memset(&device, 0, sizeof(device));
+		dev = &device;
+		strncpy(device.name, &temp[1], sizeof(device.name));
 	}
 
 	dbg("name is '%s'", dev->name);
 	udevdb_delete_dev(path);
 
-	sysbus_send_remove(name, path);
+	sysbus_send_remove(dev->name, path);
 
 	return delete_node(dev);
 }

Re: [udev] bug in udev-remove.c

[Greg KH]

On Wed, Dec 17, 2003 at 10:53:44PM +0100, Kay Sievers wrote:
> 
> Uups, we have a bug in udev-remove.c.

Ick, this was probably my fault from the merge with the dbus code,
sorry.  Thanks for the patch, I've applied it.

greg k-h


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id\x1278&alloc_id371&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Re: [udev] bug in udev-remove.c

[Kay Sievers]

[-- Attachment #1: Type: text/plain, Size: 506 bytes --]

On Wed, Dec 17, 2003 at 02:37:27PM -0800, Greg KH wrote:
> On Wed, Dec 17, 2003 at 10:53:44PM +0100, Kay Sievers wrote:
> > 
> > Uups, we have a bug in udev-remove.c.
> 
> Ick, this was probably my fault from the merge with the dbus code,
> sorry.  Thanks for the patch, I've applied it.

I've moved the malloc out of the udevdb into udev-remove to free the
struct after use and not to allocate a different struct in the case the
device is not in the data base. I seems a bit easier to read.


thanks,
Kay

[-- Attachment #2: 01-free-data-in-udev-delete.diff --]
[-- Type: text/plain, Size: 2227 bytes --]

diff -Nru a/udev-remove.c b/udev-remove.c
--- a/udev-remove.c	Thu Dec 18 03:23:11 2003
+++ b/udev-remove.c	Thu Dec 18 03:23:11 2003
@@ -119,18 +119,21 @@
 int udev_remove_device(char *path, char *subsystem)
 {
 	struct udevice *dev;
-	struct udevice device;
 	char *temp;
+	int retval;
 
-	dev = udevdb_get_dev(path);
-	if (dev == NULL) {
+	dev = malloc(sizeof(*dev));
+	if (dev == NULL)
+		return -ENOMEM;
+	memset(dev, 0, sizeof(*dev));
+
+	retval = udevdb_get_dev(path, dev);
+	if (retval) {
 		dbg("'%s' not found in database, falling back on default name", path);
 		temp = strrchr(path, '/');
 		if (temp == NULL)
 			return -ENODEV;
-		memset(&device, 0, sizeof(device));
-		dev = &device;
-		strncpy(device.name, &temp[1], sizeof(device.name));
+		strncpy(dev->name, &temp[1], sizeof(dev->name));
 	}
 
 	dbg("name is '%s'", dev->name);
@@ -138,5 +141,7 @@
 
 	sysbus_send_remove(dev->name, path);
 
-	return delete_node(dev);
+	retval = delete_node(dev);
+	free(dev);
+	return retval;
 }
diff -Nru a/udevdb.c b/udevdb.c
--- a/udevdb.c	Thu Dec 18 03:23:11 2003
+++ b/udevdb.c	Thu Dec 18 03:23:11 2003
@@ -62,29 +62,22 @@
 	return tdb_store(udevdb, key, data, TDB_REPLACE); 
 }
 
-struct udevice *udevdb_get_dev(const char *path)
+int udevdb_get_dev(const char *path, struct udevice *dev)
 {
 	TDB_DATA key, data;
-	struct udevice *dev;
 
 	if (path == NULL)
-		return NULL;
+		return -ENODEV;
 
 	key.dptr = (void *)path;
 	key.dsize = strlen(path) + 1;
 
 	data = tdb_fetch(udevdb, key);
 	if (data.dptr == NULL || data.dsize == 0)
-		return NULL;
-
-	dev = malloc(sizeof(*dev));
-	if (dev == NULL)
-		goto exit;
+		return -ENODEV;
 
 	memcpy(dev, data.dptr, sizeof(*dev));
-exit:
-	free(data.dptr);
-	return dev;
+	return 0;
 }
 
 int udevdb_delete_dev(const char *path)
diff -Nru a/udevdb.h b/udevdb.h
--- a/udevdb.h	Thu Dec 18 03:23:11 2003
+++ b/udevdb.h	Thu Dec 18 03:23:11 2003
@@ -13,7 +13,7 @@
 extern int udevdb_init(int init_flag);
 
 extern int udevdb_add_dev(const char *path, const struct udevice *dev);
-extern struct udevice *udevdb_get_dev(const char *path);
+extern int udevdb_get_dev(const char *path, struct udevice *dev);
 extern int udevdb_delete_dev(const char *path);
 
 #endif /* _UDEVDB_H_ */

Re: [udev] bug in udev-remove.c

[Greg KH]

On Thu, Dec 18, 2003 at 03:27:50AM +0100, Kay Sievers wrote:
> On Wed, Dec 17, 2003 at 02:37:27PM -0800, Greg KH wrote:
> > On Wed, Dec 17, 2003 at 10:53:44PM +0100, Kay Sievers wrote:
> > > 
> > > Uups, we have a bug in udev-remove.c.
> > 
> > Ick, this was probably my fault from the merge with the dbus code,
> > sorry.  Thanks for the patch, I've applied it.
> 
> I've moved the malloc out of the udevdb into udev-remove to free the
> struct after use and not to allocate a different struct in the case the
> device is not in the data base. I seems a bit easier to read.

I agree, nice cleanup.  I've applied this, thanks.

greg k-h


-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills.  Sign up for IBM's
Free Linux Tutorials.  Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id\x1278&alloc_id371&op=click
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel