kmodloader: fix out-of-bound access when parsing .modinfo

[project/ubox.git] / kmodloader.c

diff --git a/kmodloader.c b/kmodloader.c
index b09a323..c780379 100644 (file)
--- a/kmodloader.c
+++ b/kmodloader.c
@@ -27,7 +27,6 @@
 #include <string.h>
 #include <sys/stat.h>
 #include <fcntl.h>
-#include <syslog.h>
 #include <libgen.h>
 #include <glob.h>
 #include <elf.h>
@@ -277,38 +276,40 @@ static struct module* get_module_info(const char *module, const char *name)
 {
        int fd = open(module, O_RDONLY);
        unsigned int offset, size;
-       char *map, *strings, *dep = NULL;
-       struct module *m;
+       char *map = MAP_FAILED, *strings, *dep = NULL;
+       struct module *m = NULL;
        struct stat s;
 
-       if (!fd) {
+       if (fd < 0) {
                ULOG_ERR("failed to open %s\n", module);
-               return NULL;
+               goto out;
        }
 
        if (fstat(fd, &s) == -1) {
                ULOG_ERR("failed to stat %s\n", module);
-               return NULL;
+               goto out;
        }
 
        map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
        if (map == MAP_FAILED) {
                ULOG_ERR("failed to mmap %s\n", module);
-               return NULL;
+               goto out;
        }
 
        if (elf_find_section(map, ".modinfo", &offset, &size)) {
                ULOG_ERR("failed to load the .modinfo section from %s\n", module);
-               return NULL;
+               goto out;
        }
 
        strings = map + offset;
-       while (strings && (strings < map + offset + size)) {
+       while (true) {
                char *sep;
                int len;
 
                while (!strings[0])
                        strings++;
+               if (strings >= map + offset + size)
+                       break;
                sep = strstr(strings, "=");
                if (!sep)
                        break;
@@ -320,10 +321,16 @@ static struct module* get_module_info(const char *module, const char *name)
        }
 
        m = alloc_module(name, dep, s.st_size);
-       if (!m)
-               return NULL;
 
-       m->state = SCANNED;
+       if (m)
+               m->state = SCANNED;
+
+out:
+       if (map != MAP_FAILED)
+               munmap(map, s.st_size);
+
+       if (fd >= 0)
+               close(fd);
 
        return m;
 }
@@ -379,37 +386,40 @@ static int print_modinfo(char *module)
        int fd = open(module, O_RDONLY);
        unsigned int offset, size;
        struct stat s;
-       char *map, *strings;
+       char *map = MAP_FAILED, *strings;
+       int rv = -1;
 
-       if (!fd) {
+       if (fd < 0) {
                ULOG_ERR("failed to open %s\n", module);
-               return -1;
+               goto out;
        }
 
        if (fstat(fd, &s) == -1) {
                ULOG_ERR("failed to stat %s\n", module);
-               return -1;
+               goto out;
        }
 
        map = mmap(NULL, s.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
        if (map == MAP_FAILED) {
                ULOG_ERR("failed to mmap %s\n", module);
-               return -1;
+               goto out;
        }
 
        if (elf_find_section(map, ".modinfo", &offset, &size)) {
                ULOG_ERR("failed to load the .modinfo section from %s\n", module);
-               return -1;
+               goto out;
        }
 
        strings = map + offset;
        printf("module:\t\t%s\n", module);
-       while (strings && (strings < map + offset + size)) {
+       while (true) {
                char *dup = NULL;
                char *sep;
 
                while (!strings[0])
                        strings++;
+               if (strings >= map + offset + size)
+                       break;
                sep = strstr(strings, "=");
                if (!sep)
                        break;
@@ -426,7 +436,16 @@ static int print_modinfo(char *module)
                        free(dup);
        }
 
-       return 0;
+       rv = 0;
+
+out:
+       if (map != MAP_FAILED)
+               munmap(map, s.st_size);
+
+       if (fd >= 0)
+               close(fd);
+
+       return rv;
 }
 
 static int deps_available(struct module *m, int verbose)
@@ -434,7 +453,7 @@ static int deps_available(struct module *m, int verbose)
        char *dep;
        int err = 0;
 
-       if (!strcmp(m->depends, "-") || !strcmp(m->depends, ""))
+       if (!m->depends || !strcmp(m->depends, "-") || !strcmp(m->depends, ""))
                return 0;
 
        dep = m->depends;
@@ -466,7 +485,7 @@ static int insert_module(char *path, const char *options)
        }
 
        fd = open(path, O_RDONLY);
-       if (!fd) {
+       if (fd < 0) {
                ULOG_ERR("cannot open %s\n", path);
                return ret;
        }
@@ -593,6 +612,11 @@ static int main_insmod(int argc, char **argv)
                cur += sprintf(cur, "%s", argv[i]);
        }
 
+       if (init_module_folders()) {
+               fprintf(stderr, "Failed to find the folder holding the modules\n");
+               return -1;
+       }
+
        if (get_module_path(argv[1])) {
                name = argv[1];
        } else if (!get_module_path(name)) {
@@ -640,15 +664,26 @@ static int main_rmmod(int argc, char **argv)
 static int main_lsmod(int argc, char **argv)
 {
        struct module *m;
+       char *dep;
 
        if (scan_loaded_modules())
                return -1;
 
        avl_for_each_element(&modules, m, avl)
-               if (m->state == LOADED)
-                       printf("%-20s%8d%3d %s\n",
-                               m->name, m->size, m->usage,
-                               (*m->depends == '-') ? ("") : (m->depends));
+               if (m->state == LOADED) {
+                       printf("%-20s%8d%3d ",
+                               m->name, m->size, m->usage);
+                       if (m->depends && strcmp(m->depends, "-") && strcmp(m->depends, "")) {
+                               dep = m->depends;
+                               while (*dep) {
+                                       printf("%s", dep);
+                                       dep = dep + strlen(dep) + 1;
+                                       if (*dep)
+                                               printf(",");
+                               }
+                       }
+                       printf("\n");
+               }
 
        free_modules();
 
@@ -688,8 +723,15 @@ static int main_modprobe(int argc, char **argv)
 {
        struct module *m;
        char *name;
+       char *mod = NULL;
+       int i;
 
-       if (argc != 2)
+       for (i = 1; i < argc; i++)
+               if (argv[i][0] != '-') {
+                       mod = argv[i];
+                       break;
+               }
+       if (!mod)
                return print_usage("modprobe");
 
        if (scan_loaded_modules())
@@ -698,7 +740,7 @@ static int main_modprobe(int argc, char **argv)
        if (scan_module_folders())
                return -1;
 
-       name = get_module_name(argv[1]);
+       name = get_module_name(mod);
        m = find_module(name);
        if (m && m->state == LOADED) {
                ULOG_ERR("%s is already loaded\n", name);
@@ -730,7 +772,7 @@ static int main_modprobe(int argc, char **argv)
 static int main_loader(int argc, char **argv)
 {
        int gl_flags = GLOB_NOESCAPE | GLOB_MARK;
-       char *dir = "/etc/modules.d/*";
+       char *dir = "/etc/modules.d/";
        struct module *m;
        glob_t gl;
        char *path;
@@ -743,13 +785,17 @@ static int main_loader(int argc, char **argv)
        strcpy(path, dir);
        strcat(path, "*");
 
-       if (scan_loaded_modules())
+       if (scan_loaded_modules()) {
+               free (path);
                return -1;
+       }
 
-       if (scan_module_folders())
+       if (scan_module_folders()) {
+               free (path);
                return -1;
+       }
 
-       syslog(0, "kmodloader: loading kernel modules from %s\n", path);
+       ULOG_INFO("loading kernel modules from %s\n", path);
 
        if (glob(path, gl_flags, NULL, &gl) < 0)
                goto out;
@@ -800,6 +846,8 @@ static int main_loader(int argc, char **argv)
                avl_for_each_element(&modules, m, avl)
                        if ((m->state == PROBE) || (m->error))
                                ULOG_ERR("- %s - %d\n", m->name, deps_available(m, 1));
+       } else {
+               ULOG_INFO("done loading kernel modules from %s\n", path);
        }
 
 out:
@@ -845,5 +893,6 @@ int main(int argc, char **argv)
        if (!strcmp(exec, "modprobe"))
                return main_modprobe(argc, argv);
 
+       ulog_open(ULOG_KMSG, LOG_USER, "kmodloader");
        return main_loader(argc, argv);
 }