From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757036Ab2DFRLx (ORCPT ); Fri, 6 Apr 2012 13:11:53 -0400 Received: from anakin.london.02.net ([87.194.255.134]:55721 "EHLO anakin.london.02.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756550Ab2DFRLv (ORCPT ); Fri, 6 Apr 2012 13:11:51 -0400 X-Greylist: delayed 353 seconds by postgrey-1.27 at vger.kernel.org; Fri, 06 Apr 2012 13:11:50 EDT From: John Keeping To: netdev@vger.kernel.org Cc: John Keeping , linux-kernel@vger.kernel.org, Mihai Maruseac Subject: [PATCH] net/core: Fix seeking in /proc/net/dev Date: Fri, 6 Apr 2012 18:05:44 +0100 Message-Id: <1333731944-15808-1-git-send-email-john@keeping.me.uk> X-Mailer: git-send-email 1.7.8.5 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit f04565ddf52e4 (dev: use name hash for dev_seq_ops) introduced code that fails to check the requested position when getting an item for /proc/net/dev. This means that any code which seeks within this file is likely to receive corrupted data. A test case for this is to use the read builtin in bash: $ while read line; do echo "$line"; done --- I have made the minimal change required to fix the bug here. If desired I can spend some more time and enhance the dev_from_new_bucket and dev_from_same_bucket functions to support walking backwards as well as forwards through the items in the table. --- net/core/dev.c | 24 +++++++++++++++++++----- 1 files changed, 19 insertions(+), 5 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 6ca32f6..66b1e891 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -4040,6 +4040,7 @@ static int dev_ifconf(struct net *net, char __user *arg) struct dev_iter_state { struct seq_net_private p; + loff_t expected_pos; /* current index */ unsigned int pos; /* bucket << BUCKET_SPACE + offset */ }; @@ -4096,24 +4097,37 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq) void *dev_seq_start(struct seq_file *seq, loff_t *pos) __acquires(RCU) { + struct net_device *dev; struct dev_iter_state *state = seq->private; rcu_read_lock(); - if (!*pos) + if (!*pos) { + state->expected_pos = 0; + state->pos = 0; return SEQ_START_TOKEN; + } - /* check for end of the hash */ - if (state->pos == 0 && *pos > 1) - return NULL; + /* If we're asked for something behind where we are, start again. */ + if (state->expected_pos >= *pos) { + state->expected_pos = 0; + state->pos = 0; + } - return dev_from_new_bucket(seq); + do { + dev = dev_from_new_bucket(seq); + ++state->expected_pos; + } while (dev && state->expected_pos < *pos); + + return dev; } void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos) { struct net_device *dev; + struct dev_iter_state *state = seq->private; ++*pos; + state->expected_pos = *pos; if (v == SEQ_START_TOKEN) return dev_from_new_bucket(seq); -- 1.7.8.5