[Qemu-devel] [PATCH v2 1/2] linux-user: improve fake /proc/self/stat making `ps` not segfault.

[Qemu-devel] [PATCH v2 1/2] linux-user: improve fake /proc/self/stat making `ps` not segfault.

[Fabio Erculiani]

With the current fake /proc/self/stat implementation `ps` is
segfaulting because it expects to read PID and argv[0] as first and
second field respectively, with the latter being enclosed between
backets.

Reproducing is as easy as running: `ps` inside qemu-user chroot
with /proc mounted.

Signed-off-by: Fabio Erculiani <lxnay@sabayon.org>
---
 linux-user/syscall.c |   21 ++++++++++++++++-----
 1 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 9ba51bf..e563c00 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4678,14 +4678,25 @@ static int open_self_stat(void *cpu_env, int fd)
       int len;
       uint64_t val = 0;
 
-      if (i == 27) {
-          /* stack bottom */
-          val = start_stack;
+      if (i == 0) {
+        /* pid */
+        val = getpid();
+        snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
+      } else if (i == 1) {
+        /* app name */
+        snprintf(buf, sizeof(buf), "(%s) ", ts->bprm->argv[0]);
+      } else if (i == 27) {
+        /* stack bottom */
+        val = start_stack;
+        snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
+      } else {
+        /* for the rest, there is MasterCard */
+        snprintf(buf, sizeof(buf), "0%c", i == 43 ? '\n' : ' ');
       }
-      snprintf(buf, sizeof(buf), "%"PRId64 "%c", val, i == 43 ? '\n' : ' ');
+
       len = strlen(buf);
       if (write(fd, buf, len) != len) {
-          return -1;
+        return -1;
       }
     }
 
-- 
1.7.7

[Qemu-devel] [PATCH v2 2/2] linux-user: target_argv is placed on ts->bprm->argv and can't be freed()

[Fabio Erculiani]

---
 linux-user/main.c |    5 -----
 1 files changed, 0 insertions(+), 5 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index 788ff98..513d583 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -3492,11 +3492,6 @@ int main(int argc, char **argv, char **envp)
         _exit(1);
     }
 
-    for (i = 0; i < target_argc; i++) {
-        free(target_argv[i]);
-    }
-    free(target_argv);
-
     for (wrk = target_environ; *wrk; wrk++) {
         free(*wrk);
     }
-- 
1.7.7

Re: [Qemu-devel] [PATCH v2 2/2] linux-user: target_argv is placed on ts->bprm->argv and can't be freed()

[Alexander Graf]

You're missing a patch description and signed-off-by line :)


Alex

On 03.01.2012, at 20:20, Fabio Erculiani wrote:

> ---
> linux-user/main.c |    5 -----
> 1 files changed, 0 insertions(+), 5 deletions(-)
> 
> diff --git a/linux-user/main.c b/linux-user/main.c
> index 788ff98..513d583 100644
> --- a/linux-user/main.c
> +++ b/linux-user/main.c
> @@ -3492,11 +3492,6 @@ int main(int argc, char **argv, char **envp)
>         _exit(1);
>     }
> 
> -    for (i = 0; i < target_argc; i++) {
> -        free(target_argv[i]);
> -    }
> -    free(target_argv);
> -
>     for (wrk = target_environ; *wrk; wrk++) {
>         free(*wrk);
>     }
> -- 
> 1.7.7
> 

Re: [Qemu-devel] [PATCH v2 1/2] linux-user: improve fake /proc/self/stat making `ps` not segfault.

[Alexander Graf]

On 03.01.2012, at 20:20, Fabio Erculiani wrote:

> With the current fake /proc/self/stat implementation `ps` is
> segfaulting because it expects to read PID and argv[0] as first and
> second field respectively, with the latter being enclosed between
> backets.
> 
> Reproducing is as easy as running: `ps` inside qemu-user chroot
> with /proc mounted.
> 
> Signed-off-by: Fabio Erculiani <lxnay@sabayon.org>
> ---
> linux-user/syscall.c |   21 ++++++++++++++++-----
> 1 files changed, 16 insertions(+), 5 deletions(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 9ba51bf..e563c00 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -4678,14 +4678,25 @@ static int open_self_stat(void *cpu_env, int fd)
>       int len;
>       uint64_t val = 0;
> 
> -      if (i == 27) {
> -          /* stack bottom */
> -          val = start_stack;
> +      if (i == 0) {
> +        /* pid */
> +        val = getpid();
> +        snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
> +      } else if (i == 1) {
> +        /* app name */
> +        snprintf(buf, sizeof(buf), "(%s) ", ts->bprm->argv[0]);
> +      } else if (i == 27) {
> +        /* stack bottom */
> +        val = start_stack;
> +        snprintf(buf, sizeof(buf), "%"PRId64 " ", val);
> +      } else {
> +        /* for the rest, there is MasterCard */
> +        snprintf(buf, sizeof(buf), "0%c", i == 43 ? '\n' : ' ');
>       }
> -      snprintf(buf, sizeof(buf), "%"PRId64 "%c", val, i == 43 ? '\n' : ' ');
> +
>       len = strlen(buf);
>       if (write(fd, buf, len) != len) {
> -          return -1;
> +        return -1;

This looks suspicious :).

The rest looks good!


Alex