<div dir="ltr">Hi,<div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Oct 21, 2013 at 8:30 PM, Serge Hallyn <span dir="ltr"><<a href="mailto:serge.hallyn@ubuntu.com" target="_blank">serge.hallyn@ubuntu.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">Quoting S.Çağlar Onur (<a href="mailto:caglar@10ur.org">caglar@10ur.org</a>):<br>
> The addrlen parameter should be the actual length of socket's name for abstract sockets. Otherwise socket gets padded with NULLs.<br>
><br>
> cat /proc/net/unix | grep lxc<br>
> [...]<br>
> 0000000000000000: 00000003 00000000 00000000 0001 03 226548 @lxc/ad055575fe28ddd5//var/lib/lxc^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@<br>
> [...]<br>
><br>
> with this patch;<br>
><br>
> cat /proc/net/unix | grep lxc<br>
> [...]<br>
> 0000000000000000: 00000002 00000000 00010000 0001 01 109563 @lxc/ad055575fe28ddd5//var/lib/lxc<br>
> [...]<br>
<br>
</div>Yeah I've noticed that too :) However, you can't just take the length<br>
of the passed-in string, you need to make sure it's no larger<br>
than sizeof(addr.sun_path)-1. Is that being guaranteed somewhere else<br>
that I'm glossing over?</blockquote><div><br></div><div>Hmm I think current code path also lacks that check. As long as I see we only control the length in <span style="color:rgb(80,0,80)">lxc_af_unix_open for non-abstract case</span><span style="color:rgb(80,0,80)">. I'll add the checks and iterate one more time sometime this week.</span></div>
<div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div class="h5">
> Signed-off-by: S.Çağlar Onur <<a href="mailto:caglar@10ur.org">caglar@10ur.org</a>><br>
> ---<br>
> src/lxc/af_unix.c | 23 +++++++++++++++--------<br>
> src/lxc/monitor.c | 5 ++++-<br>
> 2 files changed, 19 insertions(+), 9 deletions(-)<br>
><br>
> diff --git a/src/lxc/af_unix.c b/src/lxc/af_unix.c<br>
> index 333f05e..2f8d593 100644<br>
> --- a/src/lxc/af_unix.c<br>
> +++ b/src/lxc/af_unix.c<br>
> @@ -20,6 +20,7 @@<br>
> * License along with this library; if not, write to the Free Software<br>
> * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA<br>
> */<br>
> +#include <stddef.h><br>
> #include <string.h><br>
> #include <unistd.h><br>
> #include <fcntl.h><br>
> @@ -55,8 +56,6 @@ int lxc_af_unix_open(const char *path, int type, int flags)<br>
> return fd;<br>
><br>
> addr.sun_family = AF_UNIX;<br>
> - /* copy entire buffer in case of abstract socket */<br>
> - len = sizeof(addr.sun_path);<br>
> if (path[0]) {<br>
> len = strlen(path);<br>
> if (len >= sizeof(addr.sun_path)) {<br>
> @@ -66,10 +65,13 @@ int lxc_af_unix_open(const char *path, int type, int flags)<br>
> errno = ENAMETOOLONG;<br>
> return -1;<br>
> }<br>
> + memcpy(addr.sun_path, path, len);<br>
> + } else {<br>
> + len = offsetof(struct sockaddr_un, sun_path) + strlen(&path[1]) + 1;<br>
> + memcpy((char *) &addr.sun_path + 1, &path[1], len);<br>
> }<br>
> - memcpy(addr.sun_path, path, len);<br>
><br>
> - if (bind(fd, (struct sockaddr *)&addr, sizeof(addr))) {<br>
> + if (bind(fd, (struct sockaddr *)&addr, len)) {<br>
> int tmp = errno;<br>
> process_lock();<br>
> close(fd);<br>
> @@ -109,6 +111,7 @@ int lxc_af_unix_close(int fd)<br>
> int lxc_af_unix_connect(const char *path)<br>
> {<br>
> int fd;<br>
> + size_t len;<br>
> struct sockaddr_un addr;<br>
><br>
> process_lock();<br>
> @@ -120,11 +123,15 @@ int lxc_af_unix_connect(const char *path)<br>
> memset(&addr, 0, sizeof(addr));<br>
><br>
> addr.sun_family = AF_UNIX;<br>
> - /* copy entire buffer in case of abstract socket */<br>
> - memcpy(addr.sun_path, path,<br>
> - path[0]?strlen(path):sizeof(addr.sun_path));<br>
> + if (path[0]) {<br>
> + len = strlen(path);<br>
> + memcpy(addr.sun_path, path, len);<br>
> + } else {<br>
> + len = offsetof(struct sockaddr_un, sun_path) + strlen(&path[1]) + 1;<br>
> + memcpy((char *) &addr.sun_path + 1, &path[1], len);<br>
> + }<br>
><br>
> - if (connect(fd, (struct sockaddr *)&addr, sizeof(addr))) {<br>
> + if (connect(fd, (struct sockaddr *)&addr, len)) {<br>
> int tmp = errno;<br>
> process_lock();<br>
> close(fd);<br>
> diff --git a/src/lxc/monitor.c b/src/lxc/monitor.c<br>
> index e736937..b965225 100644<br>
> --- a/src/lxc/monitor.c<br>
> +++ b/src/lxc/monitor.c<br>
> @@ -27,6 +27,7 @@<br>
> #include <unistd.h><br>
> #include <string.h><br>
> #include <stdlib.h><br>
> +#include <stddef.h><br>
> #include <fcntl.h><br>
> #include <inttypes.h><br>
> #include <stdint.h><br>
> @@ -194,6 +195,7 @@ int lxc_monitor_open(const char *lxcpath)<br>
> struct sockaddr_un addr;<br>
> int fd,ret;<br>
> int retry,backoff_ms[] = {10, 50, 100};<br>
> + size_t len;<br>
><br>
> if (lxc_monitor_sock_name(lxcpath, &addr) < 0)<br>
> return -1;<br>
> @@ -206,8 +208,9 @@ int lxc_monitor_open(const char *lxcpath)<br>
> return -1;<br>
> }<br>
><br>
> + len = offsetof(struct sockaddr_un, sun_path) + strlen(&addr.sun_path[1]) + 1;<br>
> for (retry = 0; retry < sizeof(backoff_ms)/sizeof(backoff_ms[0]); retry++) {<br>
> - ret = connect(fd, (struct sockaddr *)&addr, sizeof(addr));<br>
> + ret = connect(fd, (struct sockaddr *)&addr, len);<br>
> if (ret == 0 || errno != ECONNREFUSED)<br>
> break;<br>
> ERROR("connect : backing off %d", backoff_ms[retry]);<br>
> --<br>
> 1.8.3.2<br>
><br>
><br>
</div></div>> ------------------------------------------------------------------------------<br>
> October Webinars: Code for Performance<br>
> Free Intel webinars can help you accelerate application performance.<br>
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from<br>
> the latest Intel processors and coprocessors. See abstracts and register ><br>
> <a href="http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk" target="_blank">http://pubads.g.doubleclick.net/gampad/clk?id=60135991&iu=/4140/ostg.clktrk</a><br>
> _______________________________________________<br>
> Lxc-devel mailing list<br>
> <a href="mailto:Lxc-devel@lists.sourceforge.net">Lxc-devel@lists.sourceforge.net</a><br>
> <a href="https://lists.sourceforge.net/lists/listinfo/lxc-devel" target="_blank">https://lists.sourceforge.net/lists/listinfo/lxc-devel</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>S.Çağlar Onur <<a href="mailto:caglar@10ur.org">caglar@10ur.org</a>>
</div></div>