You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by "gneworld (via GitHub)" <gi...@apache.org> on 2023/09/11 02:19:43 UTC
[GitHub] [nuttx] gneworld opened a new issue, #10569: system crash when execute any builtin cmd in procfs/pm
gneworld opened a new issue, #10569:
URL: https://github.com/apache/nuttx/issues/10569
Reproducible Steps:
1. enable config CONFIG_LIBC_EXECFUNCS
2. cd /proc/pm
3. getprop
system will crash with backtrace shows below
[07/14 04:22:30] [10] [ap] elf_init: filename: getprop loadinfo: 0x3c2476c8
[07/14 04:22:30] [10] [ap] procfs_open: Open 'pm/getprop'
[07/14 04:22:30] [10] [ap] backtrace:
[07/14 04:22:30] [10] [ap] [10] [<0x2c347b86>] backtrace_unwind+0x1da/0x1dc
[07/14 04:22:30] [10] [ap] [10] [<0x2c32122c>] sched_backtrace+0x1c/0x30
[07/14 04:22:30] [10] [ap] [10] [<0x2c336ae4>] sched_dumpstack+0x20/0x68
[07/14 04:22:30] [10] [ap] [10] [<0x2c3426c6>] board_reset+0x22/0x2a8
[07/14 04:22:30] [10] [ap] [10] [<0x2c31ea48>] _assert+0x198/0x278
[07/14 04:22:30] [10] [ap] [10] [<0x2c3336a4>] __assert+0x8/0x10
[07/14 04:22:30] [10] [ap] [10] [<0x2c32be3a>] pm_open+0xbe/0x110
[07/14 04:22:30] [10] [ap] [10] [<0x2c3d5238>] procfs_open+0x20/0x30
[07/14 04:22:30] [10] [ap] [10] [<0x2c3ced54>] file_open+0x154/0x178
[07/14 04:22:30] [10] [ap] [10] [<0x2c3e57b6>] elf_init+0x2e/0x90
[07/14 04:22:30] [10] [ap] [10] [<0x2c3e520e>] elf_loadbinary+0x16/0x90
[07/14 04:22:30] [10] [ap] [10] [<0x2c3e4f78>] load_module+0x40/0x68
[07/14 04:22:30] [10] [ap] [10] [<0x2c3e50c0>] exec_spawn+0x28/0xb0
[07/14 04:22:30] [10] [ap] [10] [<0x2c323938>] posix_spawn+0x3c/0x84
[07/14 04:22:30] [10] [ap] [10] [<0x2c348cd6>] exec_builtin+0xa2/0x100
[07/14 04:22:30] [10] [ap] [10] [<0x2c34fc4e>] nsh_builtin+0x1e/0xe4
[07/14 04:22:30] [10] [ap] [10] [<0x2c34aae2>] nsh_parse_command+0x69a/0xd74
The value passed to the relpath variable is invalid, which ultimately leads to a system crash within the pm_open function call. This incorrect path ("/proc/pm/getprop") comes from the `file_open` call and is not subject to any validity checks in the current system.
So how to determine the validity of this relpath value? call procfs_stat in procfs_open is wacky, more over, procfs_stat also miss to determine the validity of this relpath value :(
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nuttx] gneworld closed issue #10569: system crash when execute any builtin cmd in procfs/pm
Posted by "gneworld (via GitHub)" <gi...@apache.org>.
gneworld closed issue #10569: system crash when execute any builtin cmd in procfs/pm
URL: https://github.com/apache/nuttx/issues/10569
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nuttx] xiaoxiang781216 closed issue #10569: system crash when execute any builtin cmd in procfs/pm
Posted by "xiaoxiang781216 (via GitHub)" <gi...@apache.org>.
xiaoxiang781216 closed issue #10569: system crash when execute any builtin cmd in procfs/pm
URL: https://github.com/apache/nuttx/issues/10569
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org