buffer overrun in /proc/mounts?

Adrian Bridgett (bridgett@hursley.ibm.com)
Thu, 8 Apr 1999 08:08:32 +0100


fs/super.c line 318:

while ( tmp && len < PAGE_SIZE - 160)
{
len += sprintf( buf + len, "%s %s %s %s",
tmp->mnt_devname, tmp->mnt_dirname,...

hmm - 160. Can we use a long name or is it limited somewhere else:

starring://Development/bridgett/output
/tmp/thisisiasdsfkjljfdlkjfdaslkjfdaslflkj/dfaslkjjfdslklkjfdasaslkjflkjfds/fdassssssssssssssssssssssssssssssssssssssss/fdasssssssssssssssssssssssnfsrw,addr=starring00

nope - that's alot longer than 160 - what would happen if I was under
PAGE_SIZE by less than 160?

The reason for all of this is that I've seen corruption when catting
/proc/net/tr_rif. Can anyone point me to the documentation on how these
functions should behave? I see some common code in lots of places but I
don't know what it's doing or the method used to handle large entries in
/proc.

Cheers

Adrian

Adrian Bridgett <bridgett@hursley.ibm.com>
Internal: 7-245528 External: 01962-815528

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/