linprocfs proc/pid/environ patch & list question

[Kostik Belousov]

On Wed, Feb 17, 2010 at 07:51:06PM +0100, Fernando Apestegu?a wrote:
> Hi,
> 
> I have a small patch (against 8.0-RELEASE-p2) that _should_ implement
> the /proc/pid/environ file
> under linprocfs.
> However, it seems it does not work properly but I don't know what I'm
> doing wrong.
> Is this list the place to ask for help? I tried in the forums[1] but
> got no answer.
Putting aside any "does not work" questions, please see comment below.
> 
> Don't we have a 'kernel newbies'-like list?
> 
> Thanks in advance.
> 
> [1] http://forums.freebsd.org/showthread.php?t=11329
> 
> --- sys/compat/linprocfs/linprocfs.c.orig	2009-10-25 02:10:29.000000000 +0100
> +++ sys/compat/linprocfs/linprocfs.c	2010-02-16 19:38:36.000000000 +0100
> @@ -939,8 +939,38 @@
>  static int
>  linprocfs_doprocenviron(PFS_FILL_ARGS)
>  {
> +	int i, error;
> +	struct ps_strings pss;
> +	char **ps_envstr;
> 
> -	sbuf_printf(sb, "doprocenviron\n%c", '\0');
> +	PROC_LOCK(p);
> +	if (p_cansee(td, p) != 0)
> +		return (0);
> +	PROC_UNLOCK(p);
> +
> +	error = copyin((void *)p->p_sysent->sv_psstrings, &pss,
> +			                    sizeof(pss));
> +	if (error)
> +		return (error);
> +
> +	ps_envstr = malloc(pss.ps_nenvstr * sizeof(char *),
> +	    M_TEMP, M_WAITOK);
This is essentially "panic me" code.  ps_nenvstr is user-controlled,
and allows to specify arbitrary integers.

Even ignoring exhaustion of the kernel map, it can cause allocation of
big amount of physical memory. Note that execve(2) implementation uses
swappable memory to store arguments and environment strings passed from
vm spaces.

> +
> +	error = copyin((void *)pss.ps_envstr, ps_envstr,
> +	    pss.ps_nenvstr * sizeof(char *));
> +
> +	if (error) {
> +		free(ps_envstr, M_TEMP);
> +		return (error);
> +	}
> +
> +	/* NULL separated list of variable=value pairs */
> +	
> +	for (i = 0; i < pss.ps_nenvstr; i++) {
> +		sbuf_copyin(sb, ps_envstr[i], 0);
> +	}
> +
> +	free(ps_envstr, M_TEMP);
>  	return (0);
>  }
> _______________________________________________
> freebsd-hackers at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
> To unsubscribe, send any mail to "freebsd-hackers-unsubscribe at freebsd.org"
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-hackers/attachments/20100217/798a7bbb/attachment.pgp