Philippe Gerum wrote: > Philippe Gerum wrote: >> Atsushi-san, >> >> Atsushi Katagiri wrote: >>> Yes, I actually encountered this bug and my Linux was crashed by NULL >>> pointer dereference. >>> >>> I think this is a very simple bug. >>> It happens "everytime" we open /proc/xenomai/stat, >>> because the last iter->nentries++; (line 466) surely reaches the value of >>> the count, >>> and the next iteration, line 449, surely overwrites zero on out of the >>> kmalloced area. >>> >> Please try this fix instead: >> > > Actually, this one is better: > > --- ksrc/nucleus/module.c (revision 4074) > +++ ksrc/nucleus/module.c (working copy) > @@ -440,13 +440,13 @@ > /* Iterate over all IRQ numbers, ... */ > for (irq = 0; irq < XNARCH_NR_IRQS; irq++) { > xnintr_t *prev = NULL; > - int cpu = 0; > + int cpu = 0, _cpu; > int err; > > /* ...over all shared IRQs on all CPUs */ > while (1) { > stat_info = &iter->stat_info[iter->nentries]; > - stat_info->cpu = cpu; > + _cpu = cpu; > > err = xnintr_query(irq, &cpu, &prev, intr_rev, > stat_info->name, > @@ -458,6 +458,7 @@ > if (err) > break; /* line unused or end of chain */ > > + stat_info->cpu = _cpu; > stat_info->pid = 0; > stat_info->state = 0; > stat_info->ssw = 0; >
Good catch. But for the sake of telling variable names I would suggest: Index: ksrc/nucleus/module.c =================================================================== --- ksrc/nucleus/module.c (Revision 4094) +++ ksrc/nucleus/module.c (Arbeitskopie) @@ -444,15 +444,15 @@ static int stat_seq_open(struct inode *i /* Iterate over all IRQ numbers, ... */ for (irq = 0; irq < XNARCH_NR_IRQS; irq++) { xnintr_t *prev = NULL; - int cpu = 0, _cpu; - int err; + int next_cpu = 0; + int cpu, err; /* ...over all shared IRQs on all CPUs */ while (1) { stat_info = &iter->stat_info[iter->nentries]; - _cpu = cpu; + cpu = next_cpu; - err = xnintr_query(irq, &cpu, &prev, intr_rev, + err = xnintr_query(irq, &next_cpu, &prev, intr_rev, stat_info->name, &stat_info->csw, &stat_info->exectime, @@ -462,7 +462,7 @@ static int stat_seq_open(struct inode *i if (err) break; /* line unused or end of chain */ - stat_info->cpu = _cpu; + stat_info->cpu = cpu; stat_info->pid = 0; stat_info->state = 0; stat_info->ssw = 0;
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Xenomai-core mailing list Xenomai-core@gna.org https://mail.gna.org/listinfo/xenomai-core