[PATCH] null-terminate over-long /proc/kallsyms symbols

Got a customer bug report (https://bugzilla.novell.com/190296) about kernel
symbols longer than 127 characters which end up in a string buffer that is
not NULL terminated, leading to garbage in /proc/kallsyms.  Using strlcpy
prevents this from happening, even though such symbols still won't come out
right.

A better fix would be to not use a fixed-size buffer, but it's probably not
worth the trouble.  (Modversion'ed symbols even have a length limit of 60.)

[bunk@stusta.de: build fix]
Signed-off-by: Andreas Gruenbacher <agruen@suse.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/include/linux/module.h b/include/linux/module.h
index d06c74fb8c262a13b4e5231ae41b489ce674ba8f..0dfb794c52d3b015bb749559202b35f65222203c 100644 (file)
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -362,10 +362,8 @@ int is_module_address(unsigned long addr);
 
 /* Returns module and fills in value, defined and namebuf, or NULL if
    symnum out of range. */
-struct module *module_get_kallsym(unsigned int symnum,
-                                 unsigned long *value,
-                                 char *type,
-                                 char namebuf[128]);
+struct module *module_get_kallsym(unsigned int symnum, unsigned long *value,
+                               char *type, char *name, size_t namelen);
 
 /* Look for this name: can be of form module:name. */
 unsigned long module_kallsyms_lookup_name(const char *name);
@@ -535,8 +533,8 @@ static inline const char *module_address_lookup(unsigned long addr,
 
 static inline struct module *module_get_kallsym(unsigned int symnum,
                                                unsigned long *value,
-                                               char *type,
-                                               char namebuf[128])
+                                               char *type, char *name,
+                                               size_t namelen)
 {
        return NULL;
 }

diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
index 39277dd6bf90911916db77f2370e2db3a6e070f4..ab16a5a4cfe9ba4c1e3009f136e4c6d11a8cffa7 100644 (file)
--- a/kernel/kallsyms.c
+++ b/kernel/kallsyms.c
@@ -275,8 +275,8 @@ static void upcase_if_global(struct kallsym_iter *iter)
 static int get_ksymbol_mod(struct kallsym_iter *iter)
 {
        iter->owner = module_get_kallsym(iter->pos - kallsyms_num_syms,
-                                        &iter->value,
-                                        &iter->type, iter->name);
+                                        &iter->value, &iter->type,
+                                        iter->name, sizeof(iter->name));
        if (iter->owner == NULL)
                return 0;
 

diff --git a/kernel/module.c b/kernel/module.c
index 35e1b1f859d715053376e638c35ec5569ca51053..2a19cd47c0469462947991e5c6ee7259b4d7ea54 100644 (file)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2019,10 +2019,8 @@ const char *module_address_lookup(unsigned long addr,
        return NULL;
 }
 
-struct module *module_get_kallsym(unsigned int symnum,
-                                 unsigned long *value,
-                                 char *type,
-                                 char namebuf[128])
+struct module *module_get_kallsym(unsigned int symnum, unsigned long *value,
+                               char *type, char *name, size_t namelen)
 {
        struct module *mod;
 
@@ -2031,9 +2029,8 @@ struct module *module_get_kallsym(unsigned int symnum,
                if (symnum < mod->num_symtab) {
                        *value = mod->symtab[symnum].st_value;
                        *type = mod->symtab[symnum].st_info;
-                       strncpy(namebuf,
-                               mod->strtab + mod->symtab[symnum].st_name,
-                               127);
+                       strlcpy(name, mod->strtab + mod->symtab[symnum].st_name,
+                               namelen);
                        mutex_unlock(&module_mutex);
                        return mod;
                }