[bug+patch] negative inode number in /proc/net/udp

[bug+patch] negative inode number in /proc/net/udp

[Arnaud Giersch]

[-- Attachment #1: Type: text/plain, Size: 1168 bytes --]


Hi,

I was playing this morning with the netstat command and had a segfault
when doing `netstat -ulp'. My kernel version is 2.4.17 on an i686.

I first searched for a bug in netstat and I discovered that it was a
negative inode number in /proc/net/udp that confused netstat:

$ cat /proc/net/udp
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode                               
[...]
  80: 00000000:02D0 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 -2127935727 2 ca5dd060              
[...]


(Before continuing, I want to tell you that it is the first time I
look so precisely in the kernel source so please tell me if I'm
wrong or I missed something.)


If I understand the kernel source, an inode number is an unsigned
value ("typedef unsigned long __kernel_ino_t;" in
linux/include/asm-i386/posix_types.h) so it shouldn't be negative.

I tried to find where /proc/net/udp is created and I found the
function get_udp_sock in linux/net/ipv4/udp.c responsible of
generating the lines.

There, the sprintf call uses %ld instead of %lu to print the inode
number. I propose the following patch:


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: udp_proc.patch --]
[-- Type: text/x-patch, Size: 514 bytes --]

diff -Naur linux.orig/net/ipv4/udp.c linux/net/ipv4/udp.c
--- linux.orig/net/ipv4/udp.c	Wed Oct 17 23:16:39 2001
+++ linux/net/ipv4/udp.c	Mon Feb 18 15:49:49 2002
@@ -957,7 +957,7 @@
 	destp = ntohs(sp->dport);
 	srcp  = ntohs(sp->sport);
 	sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
-		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %ld %d %p",
+		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p",
 		i, src, srcp, dest, destp, sp->state, 
 		atomic_read(&sp->wmem_alloc), atomic_read(&sp->rmem_alloc),
 		0, 0L, 0,

[-- Attachment #3: Type: text/plain, Size: 176 bytes --]


I don't know how to generate this kind of information in /proc, so I
didn't test it.

I also looked the 2.4.18-rc1 and 2.5.5-pre1 kernels and the bug still
exist.

-- 
Arnaud

Re: [bug+patch] negative inode number in /proc/net/udp

[Arnaud Giersch]

There is the same problem with unix sockets.

--- linux.orig/net/unix/af_unix.c       Fri Dec 21 18:42:06 2001
+++ linux/net/unix/af_unix.c    Mon Feb 18 22:01:29 2002
@@ -1742,7 +1742,7 @@
        {
                unix_state_rlock(s);
 
-               len+=sprintf(buffer+len,"%p: %08X %08X %08X %04X %02X %5ld",
+               len+=sprintf(buffer+len,"%p: %08X %08X %08X %04X %02X %5lu",
                        s,
                        atomic_read(&s->refcnt),
                        0,

-- 
Arnaud