kmodloader: fix out-of-bound access when parsing .modinfo

[project/ubox.git] / kmodloader.c

diff --git a/kmodloader.c b/kmodloader.c
index 633570f..c780379 100644 (file)
--- a/kmodloader.c
+++ b/kmodloader.c
@@ -27,7 +27,6 @@
 #include <string.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <fcntl.h>

-#include <syslog.h>

 #include <libgen.h>
 #include <glob.h>
 #include <elf.h>
 #include <libgen.h>
 #include <glob.h>
 #include <elf.h>


@@ -35,14 +34,9 @@
 #include <libubox/avl.h>
 #include <libubox/avl-cmp.h>
 #include <libubox/utils.h>
 #include <libubox/avl.h>
 #include <libubox/avl-cmp.h>
 #include <libubox/utils.h>

+#include <libubox/ulog.h>

 
 

-#define DEF_MOD_PATH "/lib/modules/%s/"
-
-#define LOG(fmt, ...) do { \
-       syslog(LOG_INFO, fmt, ## __VA_ARGS__); \
-       printf("kmod: "fmt, ## __VA_ARGS__); \
-       } while (0)
-
+#define DEF_MOD_PATH "/modules/%s/"

 
 enum {
        SCANNED,
 
 enum {
        SCANNED,


@@ -64,7 +58,51 @@ struct module {
 };
 
 static struct avl_tree modules;
 };
 
 static struct avl_tree modules;

-static char *prefix = "";
+
+static char **module_folders = NULL;
+
+static int init_module_folders(void)
+{
+       int n = 0;
+       struct stat st;
+       struct utsname ver;
+       char *s, *e, *p, path[256], ldpath[256];
+
+       e = ldpath;
+       s = getenv("LD_LIBRARY_PATH");
+
+       if (s)
+               e += snprintf(ldpath, sizeof(ldpath), "%s:", s);
+
+       e += snprintf(e, sizeof(ldpath) - (e - ldpath), "/lib");
+
+       uname(&ver);
+
+       for (s = p = ldpath; p <= e; p++) {
+               if (*p != ':' && *p != '\0')
+                       continue;
+
+               *p = 0;
+               snprintf(path, sizeof(path), "%s" DEF_MOD_PATH, s, ver.release);
+
+               if (!stat(path, &st) && S_ISDIR(st.st_mode)) {
+                       module_folders = realloc(module_folders, sizeof(p) * (n + 2));
+
+                       if (!module_folders)
+                               return -1;
+
+                       module_folders[n++] = strdup(path);
+               }
+
+               s = p + 1;
+       }
+
+       if (!module_folders)
+               return -1;
+
+       module_folders[n] = NULL;
+       return 0;
+}

 
 static struct module *find_module(const char *name)
 {
 
 static struct module *find_module(const char *name)
 {


@@ -82,18 +120,18 @@ static void free_modules(void)
 
 static char* get_module_path(char *name)
 {
 
 static char* get_module_path(char *name)
 {

+       char **p;

        static char path[256];
        static char path[256];

-       struct utsname ver;

        struct stat s;
 
        struct stat s;
 

-       if (!stat(name, &s))
+       if (!stat(name, &s) && S_ISREG(s.st_mode))

                return name;
 
                return name;
 

-       uname(&ver);
-       snprintf(path, 256, "%s" DEF_MOD_PATH "%s.ko", prefix, ver.release, name);
-
-       if (!stat(path, &s))
-               return path;
+       for (p = module_folders; *p; p++) {
+               snprintf(path, sizeof(path), "%s%s.ko", *p, name);
+               if (!stat(path, &s) && S_ISREG(s.st_mode))
+                       return path;
+       }

 
        return NULL;
 }
 
        return NULL;
 }


@@ -165,7 +203,7 @@ static int elf_find_section(char *map, const char *section, unsigned int *offset
        else if (clazz == ELFCLASS64)
                return elf64_find_section(map, section, offset, size);
 
        else if (clazz == ELFCLASS64)
                return elf64_find_section(map, section, offset, size);
 

-       LOG("unknown elf format %d\n", clazz);
+       ULOG_ERR("unknown elf format %d\n", clazz);

 
        return -1;
 }
 
        return -1;
 }


@@ -208,7 +246,7 @@ static int scan_loaded_modules(void)
 
        fp = fopen("/proc/modules", "r");
        if (!fp) {
 
        fp = fopen("/proc/modules", "r");
        if (!fp) {

-               LOG("failed to open /proc/modules\n");
+               ULOG_ERR("failed to open /proc/modules\n");

                return -1;
        }
 
                return -1;
        }
 


@@ -238,38 +276,40 @@ static struct module* get_module_info(const char *module, const char *name)
 {
        int fd = open(module, O_RDONLY);
        unsigned int offset, size;
 {
        int fd = open(module, O_RDONLY);
        unsigned int offset, size;

-       char *map, *strings, *dep = NULL;
-       struct module *m;
+       char *map = MAP_FAILED, *strings, *dep = NULL;
+       struct module *m = NULL;

        struct stat s;
 
        struct stat s;
 

-       if (!fd) {
-               LOG("failed to open %s\n", module);
-               return NULL;
+       if (fd < 0) {
+               ULOG_ERR("failed to open %s\n", module);
+               goto out;

        }
 
        if (fstat(fd, &s) == -1) {
        }
 
        if (fstat(fd, &s) == -1) {

-               LOG("failed to stat %s\n", module);
-               return NULL;
+               ULOG_ERR("failed to stat %s\n", module);
+               goto out;

        }
 
        map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
        if (map == MAP_FAILED) {
        }
 
        map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
        if (map == MAP_FAILED) {

-               LOG("failed to mmap %s\n", module);
-               return NULL;
+               ULOG_ERR("failed to mmap %s\n", module);
+               goto out;

        }
 
        if (elf_find_section(map, ".modinfo", &offset, &size)) {
        }
 
        if (elf_find_section(map, ".modinfo", &offset, &size)) {

-               LOG("failed to load the .modinfo section from %s\n", module);
-               return NULL;
+               ULOG_ERR("failed to load the .modinfo section from %s\n", module);
+               goto out;

        }
 
        strings = map + offset;
        }
 
        strings = map + offset;

-       while (strings && (strings < map + offset + size)) {
+       while (true) {

                char *sep;
                int len;
 
                while (!strings[0])
                        strings++;
                char *sep;
                int len;
 
                while (!strings[0])
                        strings++;

+               if (strings >= map + offset + size)
+                       break;

                sep = strstr(strings, "=");
                if (!sep)
                        break;
                sep = strstr(strings, "=");
                if (!sep)
                        break;


@@ -281,15 +321,21 @@ static struct module* get_module_info(const char *module, const char *name)
        }
 
        m = alloc_module(name, dep, s.st_size);
        }
 
        m = alloc_module(name, dep, s.st_size);

-       if (!m)
-               return NULL;

 
 

-       m->state = SCANNED;
+       if (m)
+               m->state = SCANNED;
+
+out:
+       if (map != MAP_FAILED)
+               munmap(map, s.st_size);
+
+       if (fd >= 0)
+               close(fd);

 
        return m;
 }
 
 
        return m;
 }
 

-static int scan_module_folder(void)
+static int scan_module_folder(const char *dir)

 {
        int gl_flags = GLOB_NOESCAPE | GLOB_MARK;
        struct utsname ver;
 {
        int gl_flags = GLOB_NOESCAPE | GLOB_MARK;
        struct utsname ver;


@@ -298,8 +344,8 @@ static int scan_module_folder(void)
        int j;
 
        uname(&ver);
        int j;
 
        uname(&ver);

-       path = alloca(sizeof(DEF_MOD_PATH "*.ko") + strlen(prefix) + strlen(ver.release) + 1);
-       sprintf(path, "%s" DEF_MOD_PATH "*.ko", prefix, ver.release);
+       path = alloca(strlen(dir) + sizeof("*.ko") + 1);
+       sprintf(path, "%s*.ko", dir);

 
        if (glob(path, gl_flags, NULL, &gl) < 0)
                return -1;
 
        if (glob(path, gl_flags, NULL, &gl) < 0)
                return -1;


@@ -321,42 +367,59 @@ static int scan_module_folder(void)
        return 0;
 }
 
        return 0;
 }
 

+static int scan_module_folders(void)
+{
+       int rv = 0;
+       char **p;
+
+       if (init_module_folders())
+               return -1;
+
+       for (p = module_folders; *p; p++)
+               rv |= scan_module_folder(*p);
+
+       return rv;
+}
+

 static int print_modinfo(char *module)
 {
        int fd = open(module, O_RDONLY);
        unsigned int offset, size;
        struct stat s;
 static int print_modinfo(char *module)
 {
        int fd = open(module, O_RDONLY);
        unsigned int offset, size;
        struct stat s;

-       char *map, *strings;
+       char *map = MAP_FAILED, *strings;
+       int rv = -1;

 
 

-       if (!fd) {
-               LOG("failed to open %s\n", module);
-               return -1;
+       if (fd < 0) {
+               ULOG_ERR("failed to open %s\n", module);
+               goto out;

        }
 
        if (fstat(fd, &s) == -1) {
        }
 
        if (fstat(fd, &s) == -1) {

-               LOG("failed to stat %s\n", module);
-               return -1;
+               ULOG_ERR("failed to stat %s\n", module);
+               goto out;

        }
 
        map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
        if (map == MAP_FAILED) {
        }
 
        map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
        if (map == MAP_FAILED) {

-               LOG("failed to mmap %s\n", module);
-               return -1;
+               ULOG_ERR("failed to mmap %s\n", module);
+               goto out;

        }
 
        if (elf_find_section(map, ".modinfo", &offset, &size)) {
        }
 
        if (elf_find_section(map, ".modinfo", &offset, &size)) {

-               LOG("failed to load the .modinfo section from %s\n", module);
-               return -1;
+               ULOG_ERR("failed to load the .modinfo section from %s\n", module);
+               goto out;

        }
 
        strings = map + offset;
        printf("module:\t\t%s\n", module);
        }
 
        strings = map + offset;
        printf("module:\t\t%s\n", module);

-       while (strings && (strings < map + offset + size)) {
+       while (true) {

                char *dup = NULL;
                char *sep;
 
                while (!strings[0])
                        strings++;
                char *dup = NULL;
                char *sep;
 
                while (!strings[0])
                        strings++;

+               if (strings >= map + offset + size)
+                       break;

                sep = strstr(strings, "=");
                if (!sep)
                        break;
                sep = strstr(strings, "=");
                if (!sep)
                        break;


@@ -373,7 +436,16 @@ static int print_modinfo(char *module)
                        free(dup);
        }
 
                        free(dup);
        }
 

-       return 0;
+       rv = 0;
+
+out:
+       if (map != MAP_FAILED)
+               munmap(map, s.st_size);
+
+       if (fd >= 0)
+               close(fd);
+
+       return rv;

 }
 
 static int deps_available(struct module *m, int verbose)
 }
 
 static int deps_available(struct module *m, int verbose)


@@ -381,7 +453,7 @@ static int deps_available(struct module *m, int verbose)
        char *dep;
        int err = 0;
 
        char *dep;
        int err = 0;
 

-       if (!strcmp(m->depends, "-") || !strcmp(m->depends, ""))
+       if (!m->depends || !strcmp(m->depends, "-") || !strcmp(m->depends, ""))

                return 0;
 
        dep = m->depends;
                return 0;
 
        dep = m->depends;


@@ -390,9 +462,9 @@ static int deps_available(struct module *m, int verbose)
                m = find_module(dep);
 
                if (verbose && !m)
                m = find_module(dep);
 
                if (verbose && !m)

-                       LOG("missing dependency %s\n", dep);
+                       ULOG_ERR("missing dependency %s\n", dep);

                if (verbose && m && (m->state != LOADED))
                if (verbose && m && (m->state != LOADED))

-                       LOG("dependency not loaded %s\n", dep);
+                       ULOG_ERR("dependency not loaded %s\n", dep);

                if (!m || (m->state != LOADED))
                        err++;
                dep += strlen(dep) + 1;
                if (!m || (m->state != LOADED))
                        err++;
                dep += strlen(dep) + 1;


@@ -408,13 +480,13 @@ static int insert_module(char *path, const char *options)
        int fd, ret = -1;
 
        if (stat(path, &s)) {
        int fd, ret = -1;
 
        if (stat(path, &s)) {

-               LOG("missing module %s\n", path);
+               ULOG_ERR("missing module %s\n", path);

                return ret;
        }
 
        fd = open(path, O_RDONLY);
                return ret;
        }
 
        fd = open(path, O_RDONLY);

-       if (!fd) {
-               LOG("cannot open %s\n", path);
+       if (fd < 0) {
+               ULOG_ERR("cannot open %s\n", path);

                return ret;
        }
 
                return ret;
        }
 


@@ -422,7 +494,7 @@ static int insert_module(char *path, const char *options)
        if (read(fd, data, s.st_size) == s.st_size)
                ret = syscall(__NR_init_module, data, (unsigned long) s.st_size, options);
        else
        if (read(fd, data, s.st_size) == s.st_size)
                ret = syscall(__NR_init_module, data, (unsigned long) s.st_size, options);
        else

-               LOG("failed to read full module %s\n", path);
+               ULOG_ERR("failed to read full module %s\n", path);

 
        close(fd);
        free(data);
 
        close(fd);
        free(data);


@@ -444,7 +516,7 @@ static void load_moddeps(struct module *_m)
                m = find_module(dep);
 
                if (!m)
                m = find_module(dep);
 
                if (!m)

-                       LOG("failed to find dependency %s\n", dep);
+                       ULOG_ERR("failed to find dependency %s\n", dep);

                if (m && (m->state != LOADED)) {
                        m->state = PROBE;
                        load_moddeps(m);
                if (m && (m->state != LOADED)) {
                        m->state = PROBE;
                        load_moddeps(m);


@@ -489,14 +561,14 @@ static int load_modprobe(void)
 
 static int print_insmod_usage(void)
 {
 
 static int print_insmod_usage(void)
 {

-       LOG("Usage:\n\tinsmod filename [args]\n");
+       ULOG_INFO("Usage:\n\tinsmod filename [args]\n");

 
        return -1;
 }
 
 static int print_usage(char *arg)
 {
 
        return -1;
 }
 
 static int print_usage(char *arg)
 {

-       LOG("Usage:\n\t%s module\n", arg);
+       ULOG_INFO("Usage:\n\t%s module\n", arg);

 
        return -1;
 }
 
        return -1;
 }


@@ -511,7 +583,7 @@ static int main_insmod(int argc, char **argv)
 
        name = get_module_name(argv[1]);
        if (!name) {
 
        name = get_module_name(argv[1]);
        if (!name) {

-               LOG("cannot find module - %s\n", argv[1]);
+               ULOG_ERR("cannot find module - %s\n", argv[1]);

                return -1;
        }
 
                return -1;
        }
 


@@ -519,7 +591,7 @@ static int main_insmod(int argc, char **argv)
                return -1;
 
        if (find_module(name)) {
                return -1;
 
        if (find_module(name)) {

-               LOG("module is already loaded - %s\n", name);
+               ULOG_ERR("module is already loaded - %s\n", name);

                return -1;
 
        }
                return -1;
 
        }


@@ -540,6 +612,11 @@ static int main_insmod(int argc, char **argv)
                cur += sprintf(cur, "%s", argv[i]);
        }
 
                cur += sprintf(cur, "%s", argv[i]);
        }
 

+       if (init_module_folders()) {
+               fprintf(stderr, "Failed to find the folder holding the modules\n");
+               return -1;
+       }
+

        if (get_module_path(argv[1])) {
                name = argv[1];
        } else if (!get_module_path(name)) {
        if (get_module_path(argv[1])) {
                name = argv[1];
        } else if (!get_module_path(name)) {


@@ -551,7 +628,7 @@ static int main_insmod(int argc, char **argv)
        free(options);
 
        if (ret)
        free(options);
 
        if (ret)

-               LOG("failed to insert %s\n", get_module_path(name));
+               ULOG_ERR("failed to insert %s\n", get_module_path(name));

 
        return ret;
 }
 
        return ret;
 }


@@ -571,13 +648,13 @@ static int main_rmmod(int argc, char **argv)
        name = get_module_name(argv[1]);
        m = find_module(name);
        if (!m) {
        name = get_module_name(argv[1]);
        m = find_module(name);
        if (!m) {

-               LOG("module is not loaded\n");
+               ULOG_ERR("module is not loaded\n");

                return -1;
        }
        ret = syscall(__NR_delete_module, m->name, 0);
 
        if (ret)
                return -1;
        }
        ret = syscall(__NR_delete_module, m->name, 0);
 
        if (ret)

-               LOG("unloading the module failed\n");
+               ULOG_ERR("unloading the module failed\n");

 
        free_modules();
 
 
        free_modules();
 


@@ -587,15 +664,26 @@ static int main_rmmod(int argc, char **argv)
 static int main_lsmod(int argc, char **argv)
 {
        struct module *m;
 static int main_lsmod(int argc, char **argv)
 {
        struct module *m;

+       char *dep;

 
        if (scan_loaded_modules())
                return -1;
 
        avl_for_each_element(&modules, m, avl)
 
        if (scan_loaded_modules())
                return -1;
 
        avl_for_each_element(&modules, m, avl)

-               if (m->state == LOADED)
-                       printf("%-20s%8d%3d %s\n",
-                               m->name, m->size, m->usage,
-                               (*m->depends == '-') ? ("") : (m->depends));
+               if (m->state == LOADED) {
+                       printf("%-20s%8d%3d ",
+                               m->name, m->size, m->usage);
+                       if (m->depends && strcmp(m->depends, "-") && strcmp(m->depends, "")) {
+                               dep = m->depends;
+                               while (*dep) {
+                                       printf("%s", dep);
+                                       dep = dep + strlen(dep) + 1;
+                                       if (*dep)
+                                               printf(",");
+                               }
+                       }
+                       printf("\n");
+               }

 
        free_modules();
 
 
        free_modules();
 


@@ -610,19 +698,19 @@ static int main_modinfo(int argc, char **argv)
        if (argc != 2)
                return print_usage("modinfo");
 
        if (argc != 2)
                return print_usage("modinfo");
 

-       if (scan_module_folder())
+       if (scan_module_folders())

                return -1;
 
        name = get_module_name(argv[1]);
        m = find_module(name);
        if (!m) {
                return -1;
 
        name = get_module_name(argv[1]);
        m = find_module(name);
        if (!m) {

-               LOG("cannot find module - %s\n", argv[1]);
+               ULOG_ERR("cannot find module - %s\n", argv[1]);

                return -1;
        }
 
        name = get_module_path(m->name);
        if (!name) {
                return -1;
        }
 
        name = get_module_path(m->name);
        if (!name) {

-               LOG("cannot find path of module - %s\n", m->name);
+               ULOG_ERR("cannot find path of module - %s\n", m->name);

                return -1;
        }
 
                return -1;
        }
 


@@ -635,23 +723,30 @@ static int main_modprobe(int argc, char **argv)
 {
        struct module *m;
        char *name;
 {
        struct module *m;
        char *name;

+       char *mod = NULL;
+       int i;

 
 

-       if (argc != 2)
+       for (i = 1; i < argc; i++)
+               if (argv[i][0] != '-') {
+                       mod = argv[i];
+                       break;
+               }
+       if (!mod)

                return print_usage("modprobe");
 
        if (scan_loaded_modules())
                return -1;
 
                return print_usage("modprobe");
 
        if (scan_loaded_modules())
                return -1;
 

-       if (scan_module_folder())
+       if (scan_module_folders())

                return -1;
 
                return -1;
 

-       name = get_module_name(argv[1]);
+       name = get_module_name(mod);

        m = find_module(name);
        if (m && m->state == LOADED) {
        m = find_module(name);
        if (m && m->state == LOADED) {

-               LOG("%s is already loaded\n", name);
+               ULOG_ERR("%s is already loaded\n", name);

                return -1;
        } else if (!m) {
                return -1;
        } else if (!m) {

-               LOG("failed to find a module named %s\n", name);
+               ULOG_ERR("failed to find a module named %s\n", name);

        } else {
                int fail;
 
        } else {
                int fail;
 


@@ -660,12 +755,12 @@ static int main_modprobe(int argc, char **argv)
                fail = load_modprobe();
 
                if (fail) {
                fail = load_modprobe();
 
                if (fail) {

-                       LOG("%d module%s could not be probed\n",
-                                       fail, (fail == 1) ? ("") : ("s"));
+                       ULOG_ERR("%d module%s could not be probed\n",
+                                fail, (fail == 1) ? ("") : ("s"));

 
                        avl_for_each_element(&modules, m, avl)
                                if ((m->state == PROBE) || m->error)
 
                        avl_for_each_element(&modules, m, avl)
                                if ((m->state == PROBE) || m->error)

-                                       LOG("- %s\n", m->name);
+                                       ULOG_ERR("- %s\n", m->name);

                }
        }
 
                }
        }
 


@@ -677,7 +772,7 @@ static int main_modprobe(int argc, char **argv)
 static int main_loader(int argc, char **argv)
 {
        int gl_flags = GLOB_NOESCAPE | GLOB_MARK;
 static int main_loader(int argc, char **argv)
 {
        int gl_flags = GLOB_NOESCAPE | GLOB_MARK;

-       char *dir = "/etc/modules.d/*";
+       char *dir = "/etc/modules.d/";

        struct module *m;
        glob_t gl;
        char *path;
        struct module *m;
        glob_t gl;
        char *path;


@@ -686,20 +781,21 @@ static int main_loader(int argc, char **argv)
        if (argc > 1)
                dir = argv[1];
 
        if (argc > 1)
                dir = argv[1];
 

-       if (argc > 2)
-               prefix = argv[2];
-

        path = malloc(strlen(dir) + 2);
        strcpy(path, dir);
        strcat(path, "*");
 
        path = malloc(strlen(dir) + 2);
        strcpy(path, dir);
        strcat(path, "*");
 

-       if (scan_loaded_modules())
+       if (scan_loaded_modules()) {
+               free (path);

                return -1;
                return -1;

+       }

 
 

-       if (scan_module_folder())
+       if (scan_module_folders()) {
+               free (path);

                return -1;
                return -1;

+       }

 
 

-       syslog(0, "kmodloader: loading kernel modules from %s\n", path);
+       ULOG_INFO("loading kernel modules from %s\n", path);

 
        if (glob(path, gl_flags, NULL, &gl) < 0)
                goto out;
 
        if (glob(path, gl_flags, NULL, &gl) < 0)
                goto out;


@@ -710,7 +806,7 @@ static int main_loader(int argc, char **argv)
                char *mod = NULL;
 
                if (!fp) {
                char *mod = NULL;
 
                if (!fp) {

-                       LOG("failed to open %s\n", gl.gl_pathv[j]);
+                       ULOG_ERR("failed to open %s\n", gl.gl_pathv[j]);

                        continue;
                }
 
                        continue;
                }
 


@@ -742,15 +838,16 @@ static int main_loader(int argc, char **argv)
        }
 
        fail = load_modprobe();
        }
 
        fail = load_modprobe();

-       LOG("ran %d iterations\n", iterations);

 
        if (fail) {
 
        if (fail) {

-               LOG("%d module%s could not be probed\n",
-                               fail, (fail == 1) ? ("") : ("s"));
+               ULOG_ERR("%d module%s could not be probed\n",
+                        fail, (fail == 1) ? ("") : ("s"));

 
                avl_for_each_element(&modules, m, avl)
                        if ((m->state == PROBE) || (m->error))
 
                avl_for_each_element(&modules, m, avl)
                        if ((m->state == PROBE) || (m->error))

-                               LOG("- %s - %d\n", m->name, deps_available(m, 1));
+                               ULOG_ERR("- %s - %d\n", m->name, deps_available(m, 1));
+       } else {
+               ULOG_INFO("done loading kernel modules from %s\n", path);

        }
 
 out:
        }
 
 out:


@@ -796,5 +893,6 @@ int main(int argc, char **argv)
        if (!strcmp(exec, "modprobe"))
                return main_modprobe(argc, argv);
 
        if (!strcmp(exec, "modprobe"))
                return main_modprobe(argc, argv);
 

+       ulog_open(ULOG_KMSG, LOG_USER, "kmodloader");

        return main_loader(argc, argv);
 }
        return main_loader(argc, argv);
 }