The patch titled
with named-pipe transport
has been added to the -mm tree. Its filename is
v9fs-transport-modules-fix-a-problem-with-named-pipe-transport.patch
Patches currently in -mm which might be from [EMAIL PROTECTED] are
v9fs-documentation-makefiles-configuration.patch
v9fs-documentation-makefiles-configuration-add-fd-based-transport-to-makefile-docs.patch
v9fs-vfs-file-dentry-and-directory-operations.patch
v9fs-vfs-inode-operations.patch
v9fs-vfs-superblock-operations-and-glue.patch
v9fs-vfs-superblock-operations-and-glue-add-fd-based-transport-to-mount-options.patch
v9fs-9p-protocol-implementation.patch
v9fs-transport-modules.patch
v9fs-transport-modules-add-fd-based-transport-module.patch
v9fs-transport-modules-fix-a-problem-with-named-pipe-transport.patch
v9fs-debug-and-support-routines.patch
v9fs-change-error-magic-numbers-to-defined-constants.patch
v9fs-clean-up-vfs_inode-and-setattr-functions.patch
v9fs-fix-support-for-special-files-devices-named-pipes-etc.patch
v9fs-readlink-extended-mode-check.patch
v9fs-fix-handling-of-malformed-9p-messages.patch
v9fs-use-standard-kernel-byteswapping.patch
v9fs-adjust-follow_link-and-put_link-to.patch
v9fs-fix-plan9port-example-in-v9fs.patch
v9fs-remove-sparse-bitwise-warnings.patch
From: Eric Van Hensbergen <[EMAIL PROTECTED]>
Found the problem. I am not sure why, but unix_mkname in net/unix/af_unix.c
writes a zero byte outside the sockaddr_un parameter. There is even a comment
that it might seem like a bug, but it is not -- I didn't understand the
explanation -- it looks like a bug to me :)
The patch that I am attaching sets addr_len parameter of ops->connect to
sizeof(struct sockaddr_un) - 1 and thus ensures that unix_mkname won't write
outside the struct. The patch also checks if the length of the unix socket
name specified in mount doesn't exceed UNIX_PATH_MAX.
Signed-off-by: Latchesar Ionkov <[EMAIL PROTECTED]>
Signed-off-by: Eric Van Hensbergen <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
---
fs/9p/trans_sock.c | 24 ++++++++++++++++--------
1 files changed, 16 insertions(+), 8 deletions(-)
diff -puN
fs/9p/trans_sock.c~v9fs-transport-modules-fix-a-problem-with-named-pipe-transport
fs/9p/trans_sock.c
---
devel/fs/9p/trans_sock.c~v9fs-transport-modules-fix-a-problem-with-named-pipe-transport
2005-08-29 22:23:32.000000000 -0700
+++ devel-akpm/fs/9p/trans_sock.c 2005-08-29 22:23:32.000000000 -0700
@@ -202,14 +202,23 @@ static int
v9fs_unix_init(struct v9fs_session_info *v9ses, const char *dev_name,
char *data)
{
- struct socket *csocket = NULL;
+ int rc;
+ struct socket *csocket;
struct sockaddr_un sun_server;
- struct v9fs_transport *trans = v9ses->transport;
- int rc = 0;
+ struct v9fs_transport *trans;
+ struct v9fs_trans_sock *ts;
- struct v9fs_trans_sock *ts =
- kmalloc(sizeof(struct v9fs_trans_sock), GFP_KERNEL);
+ rc = 0;
+ csocket = NULL;
+ trans = v9ses->transport;
+
+ if (strlen(dev_name) > UNIX_PATH_MAX) {
+ eprintk(KERN_ERR, "v9fs_trans_unix: address too long: %s\n",
+ dev_name);
+ return -ENOMEM;
+ }
+ ts = kmalloc(sizeof(struct v9fs_trans_sock), GFP_KERNEL);
if (!ts)
return -ENOMEM;
@@ -222,9 +231,8 @@ v9fs_unix_init(struct v9fs_session_info
sun_server.sun_family = PF_UNIX;
strcpy(sun_server.sun_path, dev_name);
sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
- rc = csocket->ops->connect(csocket,
- (struct sockaddr *)&sun_server,
- sizeof(struct sockaddr_un), 0);
+ rc = csocket->ops->connect(csocket, (struct sockaddr *)&sun_server,
+ sizeof(struct sockaddr_un) - 1, 0); /* -1 *is* important */
if (rc < 0) {
eprintk(KERN_ERR,
"v9fs_trans_unix: problem connecting socket: %s: %d\n",
_
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
