linux-kernel - Re: [PATCH] kernel/sysctl.c: If "count" including the terminating byte '\0' the write system call should retrun success.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 25 Aug 2015 08:57:57 +0800
From:	Sean Fu <fxinrong@...il.com>
To:	Steven Rostedt <rostedt@...dmis.org>
Cc:	Andrey Ryabinin <ryabinin.a.a@...il.com>,
	Ulrich Obergfell <uobergfe@...hat.com>,
	Prarit Bhargava <prarit@...hat.com>,
	Eric B Munson <emunson@...mai.com>,
	"Paul E. McKenney" <paulmck@...ux.vnet.ibm.com>,
	Johannes Weiner <hannes@...xchg.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Don Zickus <dzickus@...hat.com>,
	Heinrich Schuchardt <xypron.glpk@....de>,
	David Rientjes <rientjes@...gle.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kernel/sysctl.c: If "count" including the terminating
 byte '\0' the write system call should retrun success.

An application from HuaWei which works fine on 2.6 encounters this
issue on 3.0 or later kernel.

Test code:

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

#define MAXLEN (100)

int main(int argc, char** argv)
{
        int fd = 0;
        int len = 0;
        char pathname[MAXLEN] = {0};
        char buf[2] = {0};
        int ret = 0xF;
        int value = 0xF;

        if (argc < 2)
        {
                printf("Input param error, less 2 param: %s, %s.\n",
argv[0], argv[1]);
                return 1;
        }

        printf("Input: %s, %s \n", argv[0], argv[1]);

        ret = sprintf(pathname,
"/proc/sys/net/ipv4/conf/%s/rp_filter", argv[1]);
        if (ret < 0)
                printf("sprintf error, errno %d, %s\n", errno, strerror(errno));
        printf("file is: %s. \n", pathname);

        fd = open(pathname, O_RDWR, S_IRUSR);
        if (fd <=0 )
        {
                printf("open %s failed, errno=%d, %s.\n", pathname,
errno, strerror(errno));
                return 1;
        }
        printf("open %s ok, fd=%d\n", pathname, fd);

        len = write(fd, "0\0", 2);
        printf("write %d: len=%d, errno=%d, %s\n", fd, len, errno,
strerror(errno));

        close(fd);
        return 0;
}

On Tue, Aug 25, 2015 at 12:59 AM, Steven Rostedt <rostedt@...dmis.org> wrote:
> On Mon, 24 Aug 2015 16:56:13 +0800
> Sean Fu <fxinrong@...il.com> wrote:
>
>> when the input argument "count" including the terminating byte "\0",
>> The write system call return EINVAL on proc file.
>> But it return success on regular file.
>>
>> E.g. Writting two bytes ("1\0") to "/proc/sys/net/ipv4/conf/eth0/rp_filter".
>> write(fd, "1\0", 2) return EINVAL.
>
> And what would do that? What tool broke because of this?
>
>  echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter
>
> works just fine. strlen("string") would not include the nul character.
> The only thing I could think of would be a sizeof(str), but then that
> would include someone hardcoding an integer in a string, like:
>
>         char val[] = "1"
>
>         write(fd, val, sizeof(val));
>
> Again, what tool does that?
>
> If there is a tool out in the wild that use to work on 2.6 (and was
> running on 2.6 then, and not something that was created after that
> change), then we can consider this fix.
>
> -- Steve
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/