Re: [PATCH] proc: fix /proc/*/map_files lookup

Andrew Morton
2017-11-20T22:16:18Z

On Tue, 21 Nov 2017 00:27:06 +0300 Alexey Dobriyan <adobriyan@gmail.com> wrote:

> Current code does:
>
> if (sscanf(dentry->d_name.name, "%lx-%lx", start, end) != 2)
>
> However sscanf() is broken garbage.
>
> It silently accepts whitespace between format specifiers
> (did you know that?).
>
> It silently accepts valid strings which result in integer overflow.
>
> Do not use sscanf() for any even remotely reliable parsing code.
>
> OK
> # readlink '/proc/1/map_files/55a23af39000-55a23b05b000'
> /lib/systemd/systemd
>
> broken
> # readlink '/proc/1/map_files/ 55a23af39000-55a23b05b000'
> /lib/systemd/systemd
>
> broken
> # readlink '/proc/1/map_files/55a23af39000-55a23b05b000 '
> /lib/systemd/systemd
>
> very broken
> # readlink '/proc/1/map_files/1000000000000000055a23af39000-55a23b05b000'
> /lib/systemd/systemd
>
> Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
> Cc: stable@kernel.org

OK, but why is this a problem worthy of backporting into -stable kernels?