Re: [Xenomai-core] [PATCH] Buffer over flow in /proc/xenomai/stat

2008-08-04 Thread Philippe Gerum
Atsushi Katagiri wrote: Hello all. This is a small patch that fixes a serious bug. When we open /proc/xenomai/stat, function stat_seq_open kmalloc the area, write the data and increment iter-nentries. The last increment of this value reaches count, and at the next iteration

Re: [Xenomai-core] [PATCH] Buffer over flow in /proc/xenomai/stat

2008-08-04 Thread Atsushi Katagiri
Yes, I actually encountered this bug and my Linux was crashed by NULL pointer dereference. I think this is a very simple bug. It happens everytime we open /proc/xenomai/stat, because the last iter-nentries++; (line 466) surely reaches the value of the count, and the next iteration, line 449,

Re: [Xenomai-core] [PATCH] Buffer over flow in /proc/xenomai/stat

2008-08-04 Thread Philippe Gerum
Philippe Gerum wrote: Atsushi-san, Atsushi Katagiri wrote: Yes, I actually encountered this bug and my Linux was crashed by NULL pointer dereference. I think this is a very simple bug. It happens everytime we open /proc/xenomai/stat, because the last iter-nentries++; (line 466) surely