public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] binfmt_misc.c, kernel-2.4.12
@ 2001-10-19 11:54 Albert Bartoszko
  2001-10-19 12:54 ` Alexander Viro
  2001-10-21 15:26 ` Alan Cox
  0 siblings, 2 replies; 26+ messages in thread
From: Albert Bartoszko @ 2001-10-19 11:54 UTC (permalink / raw)
  To: rguenth, linux-kernel

[-- Attachment #1: Type: text/plain, Size: 863 bytes --]

Hello

I find bug in  binfmt_misc.c from kernel 2.4.12 source. The read() syscal
return bad value, causes some application SIGSEGV.

Example:

# modprobe binfmt_misc
# echo ':Java:M::\xca\xfe\xba\xbe::/usr/local/bin/javawrapper:'
>/proc/sys/fs/binfmt_misc/register

# strace less /proc/sys/fs/binfmt_misc/Java
...............................................................
...............................................................
open("/proc/sys/fs/binfmt_misc/Java", O_RDONLY) = 3
lseek(3, 1, SEEK_SET)                   = 1
lseek(3, 0, SEEK_SET)                   = 0
read(3, "enabled\ninterpreter /usr/local/b"..., 64) = 71

^^^^^^^^
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++

I send a patch I wrote that correct this problem and do same cleanup, so
source and object are a bit smaller.

Albert Bartoszko
albertb@nt.kegel.com.pl



[-- Attachment #2: binfmt_misc.patch --]
[-- Type: application/octet-stream, Size: 1725 bytes --]

--- /usr/src/linux/fs/binfmt_misc.c.org	Fri Feb  9 20:29:44 2001
+++ /usr/src/linux/fs/binfmt_misc.c	Fri Oct 19 02:32:24 2001
@@ -13,6 +13,8 @@
  *  1997-06-26 hpa: pass the real filename rather than argv[0]
  *  1997-06-30 minor cleanup
  *  1997-08-09 removed extension stripping, locking cleanup
+ *  2001-10-15 Albert Bartoszko: cleanup, 
+ *		correct return value of proc_read_status()
  */
 
 #include <linux/config.h>
@@ -354,28 +356,19 @@
 	char *dp;
 	int elen, i, err;
 
-#ifndef VERBOSE_STATUS
-	if (data) {
+	if (!data) 
+	    sprintf(page, "%s\n", "enabled");
+	else {
 		if (!(e = get_entry((int) data))) {
 			err = -ENOENT;
 			goto _err;
-		}
-		i = e->flags & ENTRY_ENABLED;
-		put_entry(e);
-	} else {
-		i = enabled;
-	} 
-	sprintf(page, "%s\n", (i ? "enabled" : "disabled"));
+		} 
+#ifndef VERBOSE_STATUS		
+    		sprintf(page, "%s\n", 
+			(e->flags & ENTRY_ENABLED) ? "enabled" : "disabled");
 #else
-	if (!data)
-		sprintf(page, "%s\n", (enabled ? "enabled" : "disabled"));
-	else {
-		if (!(e = get_entry((long) data))) {
-			err = -ENOENT;
-			goto _err;
-		}
-		sprintf(page, "%s\ninterpreter %s\n",
-		        (e->flags & ENTRY_ENABLED ? "enabled" : "disabled"),
+		sprintf(page, "%s\ninterpreter %s\n", 
+			(e->flags & ENTRY_ENABLED) ? "enabled" : "disabled",	
 			e->interpreter);
 		dp = page + strlen(page);
 		if (!(e->flags & ENTRY_MAGIC)) {
@@ -399,13 +392,14 @@
 			*dp++ = '\n';
 			*dp = '\0';
 		}
-		put_entry(e);
-	}
 #endif
-
+		put_entry(e);	
+	}
 	elen = strlen(page) - off;
 	if (elen < 0)
 		elen = 0;
+	if (elen > count)
+		elen = count;
 	*eof = (elen <= count) ? 1 : 0;
 	*start = page + off;
 	err = elen;

[-- Attachment #3: README --]
[-- Type: application/octet-stream, Size: 103 bytes --]

SUBJECT: Patch for bad return value in binfmt_misc.c, AUTHOR:Albert Bartoszko <albertb@nt.kegel.com.pl>

^ permalink raw reply	[flat|nested] 26+ messages in thread

end of thread, other threads:[~2001-10-23  7:35 UTC | newest]

Thread overview: 26+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2001-10-19 11:54 [PATCH] binfmt_misc.c, kernel-2.4.12 Albert Bartoszko
2001-10-19 12:54 ` Alexander Viro
2001-10-19 13:32   ` Richard Guenther
2001-10-19 18:48     ` Alexander Viro
2001-10-19 21:35       ` Richard Guenther
2001-10-19 22:00         ` Alexander Viro
2001-10-22  6:00   ` Albert Bartoszko
2001-10-22  6:47     ` Alexander Viro
2001-10-22  7:42       ` Keith Owens
2001-10-22  8:05         ` Alexander Viro
2001-10-22  8:21           ` Keith Owens
2001-10-22  8:33             ` Alexander Viro
2001-10-22  9:19               ` Keith Owens
2001-10-22  9:34                 ` Alexander Viro
2001-10-22  9:55                   ` Alexander Viro
2001-10-22 11:17                   ` Keith Owens
2001-10-22 11:33                     ` Alexander Viro
2001-10-22 11:52                       ` Keith Owens
2001-10-22 12:15                         ` Alexander Viro
2001-10-22 12:37                           ` Keith Owens
2001-10-22 15:56                 ` bill davidsen
2001-10-22 15:47             ` bill davidsen
2001-10-22 17:24       ` Andrew Morton
2001-10-22 17:50         ` Alexander Viro
2001-10-23  9:28       ` Albert Bartoszko
2001-10-21 15:26 ` Alan Cox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox