Re: [PATCH] proc: fix /proc/*/map_files lookup

[Andrew Morton]

On Tue, 21 Nov 2017 00:27:06 +0300 Alexey Dobriyan <adobriyan@xxxxxxxxx> wrote:

> Current code does:
> 
> 	if (sscanf(dentry->d_name.name, "%lx-%lx", start, end) != 2)
> 
> However sscanf() is broken garbage.
> 
> It silently accepts whitespace between format specifiers
> (did you know that?).
> 
> It silently accepts valid strings which result in integer overflow.
> 
> Do not use sscanf() for any even remotely reliable parsing code.
> 
> 	OK
> 	# readlink '/proc/1/map_files/55a23af39000-55a23b05b000'
> 	/lib/systemd/systemd
> 
> 	broken
> 	# readlink '/proc/1/map_files/               55a23af39000-55a23b05b000'
> 	/lib/systemd/systemd
> 
> 	broken
> 	# readlink '/proc/1/map_files/55a23af39000-55a23b05b000    '
> 	/lib/systemd/systemd
> 
> 	very broken
> 	# readlink '/proc/1/map_files/1000000000000000055a23af39000-55a23b05b000'
> 	/lib/systemd/systemd
> 
> Signed-off-by: Alexey Dobriyan <adobriyan@xxxxxxxxx>
> Cc: stable@xxxxxxxxxx

OK, but why is this a problem worthy of backporting into -stable kernels?