[PATCH] binfmt_misc.c, kernel-2.4.12

["Albert Bartoszko" <albertb@nt.kegel.com.pl>]

[-- Attachment #1: Type: text/plain, Size: 863 bytes --]

Hello

I find bug in  binfmt_misc.c from kernel 2.4.12 source. The read() syscal
return bad value, causes some application SIGSEGV.

Example:

# modprobe binfmt_misc
# echo ':Java:M::\xca\xfe\xba\xbe::/usr/local/bin/javawrapper:'
>/proc/sys/fs/binfmt_misc/register

# strace less /proc/sys/fs/binfmt_misc/Java
...............................................................
...............................................................
open("/proc/sys/fs/binfmt_misc/Java", O_RDONLY) = 3
lseek(3, 1, SEEK_SET)                   = 1
lseek(3, 0, SEEK_SET)                   = 0
read(3, "enabled\ninterpreter /usr/local/b"..., 64) = 71

^^^^^^^^
--- SIGSEGV (Segmentation fault) ---
+++ killed by SIGSEGV +++

I send a patch I wrote that correct this problem and do same cleanup, so
source and object are a bit smaller.

Albert Bartoszko
albertb@nt.kegel.com.pl



[-- Attachment #2: binfmt_misc.patch --]
[-- Type: application/octet-stream, Size: 1725 bytes --]

--- /usr/src/linux/fs/binfmt_misc.c.org	Fri Feb  9 20:29:44 2001
+++ /usr/src/linux/fs/binfmt_misc.c	Fri Oct 19 02:32:24 2001
@@ -13,6 +13,8 @@
  *  1997-06-26 hpa: pass the real filename rather than argv[0]
  *  1997-06-30 minor cleanup
  *  1997-08-09 removed extension stripping, locking cleanup
+ *  2001-10-15 Albert Bartoszko: cleanup, 
+ *		correct return value of proc_read_status()
  */
 
 #include <linux/config.h>
@@ -354,28 +356,19 @@
 	char *dp;
 	int elen, i, err;
 
-#ifndef VERBOSE_STATUS
-	if (data) {
+	if (!data) 
+	    sprintf(page, "%s\n", "enabled");
+	else {
 		if (!(e = get_entry((int) data))) {
 			err = -ENOENT;
 			goto _err;
-		}
-		i = e->flags & ENTRY_ENABLED;
-		put_entry(e);
-	} else {
-		i = enabled;
-	} 
-	sprintf(page, "%s\n", (i ? "enabled" : "disabled"));
+		} 
+#ifndef VERBOSE_STATUS		
+    		sprintf(page, "%s\n", 
+			(e->flags & ENTRY_ENABLED) ? "enabled" : "disabled");
 #else
-	if (!data)
-		sprintf(page, "%s\n", (enabled ? "enabled" : "disabled"));
-	else {
-		if (!(e = get_entry((long) data))) {
-			err = -ENOENT;
-			goto _err;
-		}
-		sprintf(page, "%s\ninterpreter %s\n",
-		        (e->flags & ENTRY_ENABLED ? "enabled" : "disabled"),
+		sprintf(page, "%s\ninterpreter %s\n", 
+			(e->flags & ENTRY_ENABLED) ? "enabled" : "disabled",	
 			e->interpreter);
 		dp = page + strlen(page);
 		if (!(e->flags & ENTRY_MAGIC)) {
@@ -399,13 +392,14 @@
 			*dp++ = '\n';
 			*dp = '\0';
 		}
-		put_entry(e);
-	}
 #endif
-
+		put_entry(e);	
+	}
 	elen = strlen(page) - off;
 	if (elen < 0)
 		elen = 0;
+	if (elen > count)
+		elen = count;
 	*eof = (elen <= count) ? 1 : 0;
 	*start = page + off;
 	err = elen;

[-- Attachment #3: README --]
[-- Type: application/octet-stream, Size: 103 bytes --]

SUBJECT: Patch for bad return value in binfmt_misc.c, AUTHOR:Albert Bartoszko <albertb@nt.kegel.com.pl>