Received: by 2002:ac0:a5a6:0:0:0:0:0 with SMTP id m35-v6csp7045026imm; Tue, 28 Aug 2018 05:38:00 -0700 (PDT) X-Google-Smtp-Source: ANB0VdZdVNMgWfNb3o7FeTovb/ZbwunZRnA2RDvMTpwiHL2WYnWHDlkau8CvPo8Ce+vI7KmcT0b8 X-Received: by 2002:a63:788b:: with SMTP id t133-v6mr1355148pgc.329.1535459880599; Tue, 28 Aug 2018 05:38:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1535459880; cv=none; d=google.com; s=arc-20160816; b=tDiu0uvpEg6tuq5lyWYG48NLguY9FCJsKWTwcZMBsS2rF9pQ5QoqvD/4q6H8ONtsyu xGh6KzX78zwd29ZProntkZ2Gj/fZBwMeK7JI2wuznX52/v0lKBotkLF9MXPZkYKcqv6a IQ2NMGgQsUlpLFJEUlDT/6ULcKLEFhAJ9FOHpbiqYLzhJprMJTcsl0FLozEzGQYfv6pc tT7CJPUgLjswOo8fec/5K/zAKXrH8nIr3fvAktaYHQV0Ts10T2QeuYP58ljDRPkt9Kvt 0qW4xHAwIKHGIpy9G5UBh14qL3J7rg/EVA3IVtbIXgbFbkRiaFPvvL4bio+PnxXW2QVs C7rQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:dkim-signature:arc-authentication-results; bh=05kE+rEM/SVtQM4ag8xkAlkFSh7FQJHB6Uzw1ymvp0M=; b=V2VauZi2V+NO8msULyqre+mEGzvk8cazOwd5i1ik9G26rB/3zlMu7OsT/LYFQd0jUe e52tkblgWKb34SiXNqBhKf0B18tLU2mA5GH5Cv3MW415mY3oERdRcIAknSZKbDGWL9wx NYn5+GU+DEDWeUkIqf65pi0wjheSGbkqHQG6cooc+3DOss+F5+WUnhKBJTO3A5MT4zqL irYKhIatgSV188Q6CYvc8SOT/5CNW5+OONJOyVSC6vPkqrxHhxb2t/RLHW0H+RWHnmY7 +X8+SJcR5fgPze2OZLwnR83DlfkMrhK9dEicXDOZf3e6OPqBcgg0BusdMEhHrQHbnTRB 1Mdw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=rPUU7utf; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e10-v6si1058267pln.161.2018.08.28.05.37.45; Tue, 28 Aug 2018 05:38:00 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=rPUU7utf; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727943AbeH1Q15 (ORCPT + 99 others); Tue, 28 Aug 2018 12:27:57 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:36406 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726120AbeH1Q14 (ORCPT ); Tue, 28 Aug 2018 12:27:56 -0400 Received: by mail-wm0-f66.google.com with SMTP id j192-v6so1853572wmj.1 for ; Tue, 28 Aug 2018 05:36:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=05kE+rEM/SVtQM4ag8xkAlkFSh7FQJHB6Uzw1ymvp0M=; b=rPUU7utfP1hYg11HbjT52vZr6DX3B9lEkMKS69kqAV8E+jkaEeurohKTKCVe1soYG/ Ui0zr/+/1bgk1Af+0grt4jB3l8fgBxskvWxsp5Q7nDe9Ne6ypag42/I3gVbBJUQ9t0+E 9XAEfFp2skDkO1M/DYHjGTaGok4kYBxeemOoJDrH1VGvwaOGfIXi/6U+4nNc0Vydw3Ui GRkDhNJyXM6xVmjDaMaVpAFjT4GWjNcQHr3gpSkJKwITs73tA+jKpY08VoBF2R5h2Iqw WS9W2d4pbXnDlGSroRg8CAV44jJcUVJZOn3BB7q11iVu9p7GdUal4twMgCGj/JdKawBY eGIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=05kE+rEM/SVtQM4ag8xkAlkFSh7FQJHB6Uzw1ymvp0M=; b=ftqKr2kNs0ipefZVdKwGAiE88yqh7zmJ6bCHvaOkiEUAG6Z0chcP8HNEoeWbjRf1+b pV6GYJNiX2m+khRONj50zhYPu9d4b+JVxJsoi1R4cgwrNNIza5OSp1RZmeaRFDDDu+90 YdWxUU4Noy9IFnv4Mb6KF0qz7oeUmUoLWtuJdn8F9HJIaP/w/djB7TwM+aiZnYnaW0CO erueIJcAvYualL+kOJH00o9crS6CefS0pXRgWEM0NXGSIRN1JVrM8UqknixhVT4ToXTO sdTBEQIDI9AmeepazhuRpucEJBLkXkhWk4AE6ZtLlXtPEJmh3FQAlJTrPnz4gm3hGSj/ tXAA== X-Gm-Message-State: APzg51Bhyt/qKEDkjHaXYPRnbqZp1QVBlkt/dtX6qBqlqkQCZL1Uu3bI r11tfegr2s2J3xL7YfhuVGU= X-Received: by 2002:a1c:c64c:: with SMTP id w73-v6mr1166257wmf.98.1535459787681; Tue, 28 Aug 2018 05:36:27 -0700 (PDT) Received: from darwi-kernel ([142.93.171.10]) by smtp.gmail.com with ESMTPSA id b144-v6sm922718wmd.23.2018.08.28.05.36.26 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 28 Aug 2018 05:36:26 -0700 (PDT) Date: Tue, 28 Aug 2018 12:36:22 +0000 From: "Ahmed S. Darwish" To: Alexey Dobriyan Cc: akpm@linux-foundation.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 11/13] proc: readdir /proc/*/task Message-ID: <20180828123622.GA2087@darwi-kernel> References: <20180827231503.26899-1-adobriyan@gmail.com> <20180827231503.26899-11-adobriyan@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180827231503.26899-11-adobriyan@gmail.com> User-Agent: Mutt/1.9.4 (2018-02-28) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Aug 28, 2018 at 02:15:01AM +0300, Alexey Dobriyan wrote: > --- > fs/proc/base.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > Missing description and S-o-b. Further comments below.. > diff --git a/fs/proc/base.c b/fs/proc/base.c > index 33f444721965..668e465c86b3 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -3549,11 +3549,11 @@ static int proc_task_readdir(struct file *file, struct dir_context *ctx) > for (task = first_tid(proc_pid(inode), tid, ctx->pos - 2, ns); > task; > task = next_tid(task), ctx->pos++) { > - char name[10 + 1]; > - unsigned int len; > + char name[10], *p = name + sizeof(name); > + Multiple issues: - len should be 11, as was in the original code (0xffffffff = 4294967295, 10 letters) - while we're at it, let's use a constant for the '11' instead of mysterious magic numbers - 'p' is clearly overflowing the stack here > tid = task_pid_nr_ns(task, ns); > - len = snprintf(name, sizeof(name), "%u", tid); > - if (!proc_fill_cache(file, ctx, name, len, > + p = _print_integer_u32(p, tid); > + if (!proc_fill_cache(file, ctx, p, name + sizeof(name) - p, You're replacing snprintf() code __that did proper len checking__ with code that does not. That's not good. I can't see how the fourth proc_fill_cache() parameter, ``name + sizeof(name)'' safely ever replace the original 'len' parameter. It's a pointer value .. (!) Overall this looks like a broken patch submitted by mistake. Thanks, -- Darwish http://darwish.chasingpointers.com