[devfs] Use before initialisation in devfs_mk_cdev()

[devfs] Use before initialisation in devfs_mk_cdev()

[Gergely Nagy]

Hi!

While playing around with implementing my first linux 2.5 module, I
stumbled upon a buglet in devfs (though, if used properly, it probably
won't surface ever). The problem - as I see it - is that
devfs_mk_cdev() first checks the mode passed to it, and if it thinks
it is not a char device, it prints a warning and aborts. Now, this
printing involves the local variable `buf' (char buf[64]), which is
not initialised at that point.

The problematic code is:

int devfs_mk_cdev(dev_t dev, umode_t mode, const char *fmt, ...)
{
	struct devfs_entry *dir = NULL, *de;
	char buf[64];
	va_list args;
	int error, n;

	if (!S_ISCHR(mode)) {
		printk(KERN_WARNING "%s: invalide mode (%u) for %s\n",
				__FUNCTION__, mode, buf);
		return -EINVAL;
	}

One option would be to try to initialise buf earlier, another would be
to just remove the "for %s" part, and the buf reference in the printk
(but that way, some information would be lost).

Anyways, I just noticed that when my buggy code called devfs_mk_cdev
(blah, 0, etc..) it printed garbage on module insertion, so I thought
I'd drop a notice.

Oh, this is with Linux 2.6.0-test1-mm1.

Cheers,
-- 
Gergely Nagy

Re: [devfs] Use before initialisation in devfs_mk_cdev()

[Christoph Hellwig]

On Thu, Jul 17, 2003 at 01:53:42AM +0200, Gergely Nagy wrote:
> Hi!
> 
> While playing around with implementing my first linux 2.5 module, I
> stumbled upon a buglet in devfs (though, if used properly, it probably
> won't surface ever). The problem - as I see it - is that
> devfs_mk_cdev() first checks the mode passed to it, and if it thinks
> it is not a char device, it prints a warning and aborts. Now, this
> printing involves the local variable `buf' (char buf[64]), which is
> not initialised at that point.

Sorry, my fault.  I had a report on this earlier but didn't submit
a patch yet.  The same problem also affects devfs_mk_bdev.

Linus, please apply the patch below.


--- 1.95/fs/devfs/base.c	Fri Jul 11 01:24:00 2003
+++ edited/fs/devfs/base.c	Fri Jul 18 11:36:24 2003
@@ -1432,12 +1432,6 @@
 	va_list args;
 	int error, n;
 
-	if (!S_ISBLK(mode)) {
-		printk(KERN_WARNING "%s: invalide mode (%u) for %s\n",
-				__FUNCTION__, mode, buf);
-		return -EINVAL;
-	}
-
 	va_start(args, fmt);
 	n = vsnprintf(buf, 64, fmt, args);
 	if (n >= 64 || !buf[0]) {
@@ -1445,6 +1439,12 @@
 				__FUNCTION__);
 		return -EINVAL;
 	}
+	
+	if (!S_ISBLK(mode)) {
+		printk(KERN_WARNING "%s: invalide mode (%u) for %s\n",
+				__FUNCTION__, mode, buf);
+		return -EINVAL;
+	}
 
 	de = _devfs_prepare_leaf(&dir, buf, mode);
 	if (!de) {
@@ -1478,17 +1478,17 @@
 	va_list args;
 	int error, n;
 
-	if (!S_ISCHR(mode)) {
-		printk(KERN_WARNING "%s: invalide mode (%u) for %s\n",
-				__FUNCTION__, mode, buf);
-		return -EINVAL;
-	}
-
 	va_start(args, fmt);
 	n = vsnprintf(buf, 64, fmt, args);
 	if (n >= 64 || !buf[0]) {
 		printk(KERN_WARNING "%s: invalid format string\n",
 				__FUNCTION__);
+		return -EINVAL;
+	}
+
+	if (!S_ISCHR(mode)) {
+		printk(KERN_WARNING "%s: invalide mode (%u) for %s\n",
+				__FUNCTION__, mode, buf);
 		return -EINVAL;
 	}