Skip to contentSkip to conversation

proc: fix /proc/*/map_files lookup some more

PATCH In review Alexey Dobriyan 2 participants 2 messages Mar 3, 2018 – Mar 4, 2018

Subsystems (2)
lore
Share & tools
lore
#0 lore raw

PATCH v2 1/1 proc: fix /proc/*/map_files lookup some more

I totally forgot that _parse_integer() accepts arbitrary amount of leading zeroes leading to the following lookups:

		OK
	# readlink /proc/1/map_files/56427ecba000-56427eddc000
	/lib/systemd/systemd

		bogus
	# readlink /proc/1/map_files/00000000000056427ecba000-56427eddc000
	/lib/systemd/systemd
	# readlink /proc/1/map_files/56427ecba000-00000000000056427eddc000
	/lib/systemd/systemd

---

 fs/proc/base.c                                         |    4 
 tools/testing/selftests/proc/.gitignore                |    4 
 tools/testing/selftests/proc/Makefile                  |    2 
 tools/testing/selftests/proc/proc-self-map-files-001.c |   82 ++++++++++++++++
 tools/testing/selftests/proc/proc-self-map-files-002.c |   85 +++++++++++++++++
 5 files changed, 176 insertions(+), 1 deletion(-)
fs/proc/base.c +4 -0
@@ -1916,6 +1916,8 @@ static int dname_to_vma_addr(struct dentry *dentry,
 	unsigned long long sval, eval;
 	unsigned int len;
 
+	if (str[0] == '0' && str[1] != '-')
+		return -EINVAL;
 	len = _parse_integer(str, 16, &sval);
 	if (len & KSTRTOX_OVERFLOW)
 		return -EINVAL;
@@ -1927,6 +1929,8 @@ static int dname_to_vma_addr(struct dentry *dentry,
 		return -EINVAL;
 	str++;
 
+	if (str[0] == '0' && str[1])
+		return -EINVAL;
 	len = _parse_integer(str, 16, &eval);
 	if (len & KSTRTOX_OVERFLOW)
 		return -EINVAL;
tools/testing/selftests/proc/.gitignore +3 -1
@@ -1,2 +1,4 @@
-/proc-self-mem
+/proc-self-map-files-001
+/proc-self-map-files-002
 /proc-self-syscall
+/proc-self-wchan
tools/testing/selftests/proc/Makefile +2 -0
@@ -1,6 +1,8 @@
 CFLAGS += -Wall -O2
 
 TEST_GEN_PROGS :=
+TEST_GEN_PROGS += proc-self-map-files-001
+TEST_GEN_PROGS += proc-self-map-files-002
 TEST_GEN_PROGS += proc-self-syscall
 TEST_GEN_PROGS += proc-self-wchan
 

new file mode 100644

tools/testing/selftests/proc/proc-self-map-files-001.c new file +82 -0

82 lines not on this page · raw message

new file mode 100644

tools/testing/selftests/proc/proc-self-map-files-002.c new file +85 -0

85 lines not on this page · raw message

Reviewed-by on v2 1/1
#1 lore raw
Quoted 13 lines · Alexey Dobriyan

I totally forgot that _parse_integer() accepts arbitrary amount of leading zeroes leading to the following lookups:

		OK
	# readlink /proc/1/map_files/56427ecba000-56427eddc000
	/lib/systemd/systemd

		bogus
	# readlink /proc/1/map_files/00000000000056427ecba000-56427eddc000
	/lib/systemd/systemd
	# readlink /proc/1/map_files/56427ecba000-00000000000056427eddc000
	/lib/systemd/systemd
Quoted 1 line