Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755363Ab2HQC3n (ORCPT ); Thu, 16 Aug 2012 22:29:43 -0400 Received: from mga01.intel.com ([192.55.52.88]:25577 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752282Ab2HQC3l (ORCPT ); Thu, 16 Aug 2012 22:29:41 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.77,782,1336374000"; d="scan'208";a="203213089" Date: Fri, 17 Aug 2012 10:29:39 +0800 From: Fengguang Wu To: Greg Kroah-Hartman Cc: Cornelia Huck , devel@driverdev.osuosl.org, Kay Sievers , Alan Stern , LKML Subject: Re: show_uevent() and general protection fault Message-ID: <20120817022939.GA24650@localhost> References: <20120713083140.GA19738@localhost> <20120713084616.GA20037@localhost> <20120717013342.GD21914@kroah.com> <20120718051552.GA9124@localhost> <20120816172711.GB27415@kroah.com> <20120817020608.GA24538@localhost> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20120817020608.GA24538@localhost> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4176 Lines: 95 > > --- tip.orig/drivers/base/core.c 2012-08-17 08:48:07.101972082 +0800 > > +++ tip/drivers/base/core.c 2012-08-17 09:49:43.665912992 +0800 > > @@ -343,8 +343,11 @@ static ssize_t show_uevent(struct device > > goto out; > > > > /* copy keys to file */ > > - for (i = 0; i < env->envp_idx; i++) > > + printk(KERN_ERR "uevent %d env[%d]: %s/.../%s\n", env->buflen, env->envp_idx, top_kobj->name, dev->kobj.name); > > + for (i = 0; i < env->envp_idx; i++) { > > + printk(KERN_ERR "uevent %d env[%d]: %s\n", (int)count, i, env->envp[i]); > > count += sprintf(&buf[count], "%s\n", env->envp[i]); > > + } > > out: > > kfree(env); > > return count; > > It's printing 32 strings of "(null)\n" (7 characters each) to the buffer, > which eventually overflows it. > > [ 65.968387] uevent 12 env[1627389952]: LNXCPU:01/.../LNXCPU:01 > [ 65.969586] uevent 0 env[0]: (null) Something obviously wrong here: env->buflen == 12 env->envp_idx == 1627389952 env->env[0] == NULL I'm not sure where it comes from, but if it's possible for random drivers to create that bad env, we could add some sanity check here to at least prevent the panic. Thanks, Fengguang > [ 65.970463] uevent 7 env[1]: (null) > [ 65.971338] uevent 14 env[2]: (null) > [ 65.972225] uevent 21 env[3]: (null) > [ 65.973111] uevent 28 env[4]: (null) > [ 65.973952] uevent 35 env[5]: (null) > [ 65.974852] uevent 42 env[6]: (null) > [ 65.975735] uevent 49 env[7]: (null) > [ 65.976627] uevent 56 env[8]: (null) > [ 65.977545] uevent 63 env[9]: (null) > [ 65.978469] uevent 70 env[10]: (null) > [ 65.979410] uevent 77 env[11]: (null) > [ 65.980321] uevent 84 env[12]: (null) > [ 65.981243] uevent 91 env[13]: (null) > [ 65.982159] uevent 98 env[14]: (null) > [ 65.983080] uevent 105 env[15]: (null) > [ 65.983972] uevent 112 env[16]: (null) > [ 65.984908] uevent 119 env[17]: (null) > [ 65.985850] uevent 126 env[18]: (null) > [ 65.986797] uevent 133 env[19]: (null) > [ 65.987768] uevent 140 env[20]: (null) > [ 65.988723] uevent 147 env[21]: (null) > [ 65.989661] uevent 154 env[22]: (null) > [ 65.990591] uevent 161 env[23]: (null) > [ 65.991527] uevent 168 env[24]: (null) > [ 65.992452] uevent 175 env[25]: (null) > [ 65.993383] uevent 182 env[26]: (null) > [ 65.994386] uevent 189 env[27]: (null) > [ 65.995342] uevent 196 env[28]: (null) > [ 65.996289] uevent 203 env[29]: (null) > [ 65.997243] uevent 210 env[30]: (null) > [ 65.998197] uevent 217 env[31]: (null) > [ 65.999124] general protection fault: 0000 [#1] PREEMPT > [ 66.000106] CPU 0 > [ 66.000106] Pid: 128, comm: trinity-child0 Not tainted 3.6.0-rc1-bisect2-00037-gdfdf036-dirty #8 Bochs Bochs > [ 66.000106] RIP: 0010:[] [] strnlen+0x2e/0x37 > ... > [ 66.000106] Call Trace: > [ 66.000106] [] string.isra.3+0x49/0xe6 > [ 66.000106] [] vsnprintf+0x267/0x6dd > [ 66.000106] [] ? compat_sys_clock_gettime+0x12/0x91 > [ 66.000106] [] ? retint_restore_args+0x13/0x13 > [ 66.000106] [] vscnprintf+0x16/0x3a > [ 66.000106] [] vprintk_emit+0x313/0x66f > [ 66.000106] [] ? vsnprintf+0xa1/0x6dd > [ 66.000106] [] printk+0x4f/0x58 > [ 66.000106] [] show_uevent+0x164/0x1db > [ 66.000106] [] dev_attr_show+0x29/0x77 > [ 66.000106] [] ? sysfs_read_file+0xc5/0x221 > [ 66.000106] [] ? __get_free_pages+0x2f/0x6a > [ 66.000106] [] sysfs_read_file+0xfd/0x221 > [ 66.000106] [] vfs_read+0xdb/0x1c1 > [ 66.000106] [] sys_read+0x56/0x9e > > Thanks, > Fengguang -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/