Sponsored Content
Full Discussion: Problem about Kernel oops
Top Forums Programming Problem about Kernel oops Post 302588222 by Corona688 on Saturday 7th of January 2012 04:39:04 PM
Old 01-07-2012
Quote:
Originally Posted by homeboy
hello,everyone,I'm reading LDD3.Topics about oops,it said the code bellow would cause a fault condition because "this method copies a string to a local variable,unfortunately,the string is longer than the destination array".Well,hard to understand....Is that right?I thought the fault should be caused by the wrong memset,it overwrite the function stack,the value of __user is 0xff now.will anyone tell me what happened here?Thanks;
Code:
size_t fauly_read(struct file *filp, char __user *buf, size_t count, loff_t *pos)
{
      int ret;
      char stack_buf[4];

      memset(stack_buf, 0xff, 20);
      if(count > 4)
           count  = 4;

      ret = copy_to_user(buf, stack_buf, count);
      if(!ret)
          return count;

      return ret;
}

It's writing 20 bytes to an array 4 bytes long, rampaging 16 more bytes across memory it shouldn't, trashing things like local variable values, function parameters, and return locations, all of which are kept in the same general area of stack here.

You're both right, in other words. There's many possible problems that could be caused by this, not just corruption of the return vector. If you're lucky, it crashes immediately. If you're unlucky, it puts bizarre values into your local variables and function parameters, causing behavior that's very difficult to rationally explain.
This User Gave Thanks to Corona688 For This Post:
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

oops! Style Manager

Solaris 2.6, using CDE: agh. I accidentally set an ugly palette as my Home Session. The problem is, when I change the palette back to Default, I am informed that my change will be apparent in my next session. But when I log out and in, it's still the Ugly Palette. Doesn't matter if I set the... (1 Reply)
Discussion started by: kristy
1 Replies

2. UNIX for Advanced & Expert Users

oops on mount

When ever i mount any of my 2 scsi cdroms, I get a kernel crash with the folfollowing oops kernel output. I understand that it is impossible to anwser my question WHY but could you give me some advice where i should look to debug the problem or advice me some tools to detect what might be... (3 Replies)
Discussion started by: progressdll
3 Replies

3. Solaris

oops...accidentally overwrote postfix aliases file

I have directory/dns server running sparc solaris 9. while troubleshooting another issue, i overwrote the aliases file on accident. my question is: is there any way to revert this? any help super appreciated...especially since this a production box! (2 Replies)
Discussion started by: JeepResQ
2 Replies

4. UNIX for Advanced & Expert Users

kernel call problem

hi all I want to make a kernel call which takes as input an integer x and prints 2*x Anyone who knows how could i do that? (1 Reply)
Discussion started by: sasa
1 Replies

5. Programming

Oops

Hi All, Can any one please differenciate between the Data Abstraction and Encapsulation? If possible, with code. Thanks in Advance, Naga:cool: (2 Replies)
Discussion started by: Nagapandi
2 Replies

6. Ubuntu

500 OOPS: vsftpd: cannot locate user specified in 'ftp_username':ftp

I've been tearing my hair out over this: vsftp does not work on any of my RedHat Server 5.x systems - I keep getting a variation on 500 OOPS: vsftpd: cannot locate user specified in 'ftp_username':ftp or 500 OOPS: cannot locate user entry:nobody (different errors on different systems). I spent... (2 Replies)
Discussion started by: thomn8r
2 Replies

7. Red Hat

Kernel Panic problem

Hi all, When i load my block device driver in Fedoracore10 kernel 2.6.27. i got this type of error kernel panic - not syncing : Fatal exception in interrupt. I am unable to save the log file.... Can any one help me..... regards sundar (4 Replies)
Discussion started by: sundhar
4 Replies

8. UNIX for Dummies Questions & Answers

chmod 777 * - oops

I can belive I really did this... chmod 777 /home :eek: I have my /home directory synced to another machine. Can anyone tell me how to get the permissions from back up server /home to production server /home It's important that I dont over write the files on the... (1 Reply)
Discussion started by: shunter63
1 Replies

9. Linux

Kernel/DISK problem

Hey guys i got this error in my logs: from dmesg: What does this error indicates? (6 Replies)
Discussion started by: sbn
6 Replies

10. Linux

500 OOPS: vsftpd: cannot locate user specified in 'ftp_username':ftp

I've been fighting this for about a year: vsftp does not work on any of my RedHat Server 5.x systems - I keep getting a variation on 500 OOPS: vsftpd: cannot locate user specified in 'ftp_username':ftp or 500 OOPS: cannot locate user entry:nobody (different errors on different systems). I spent... (0 Replies)
Discussion started by: thomn8r
0 Replies
memory(3C)						   Standard C Library Functions 						memory(3C)

NAME
memory, memccpy, memchr, memcmp, memcpy, memmove, memset - memory operations SYNOPSIS
#include <string.h> void *memccpy(void *restrict s1, const void *restrict s2, int c, size_t n); void *memchr(const void *s, int c, size_t n); int memcmp(const void *s1, const void *s2, size_t n); void *memcpy(void *restrict s1, const void *restrict s2, size_t n); void *memmove(void *s1, const void *s2, size_t n); void *memset(void *s, int c, size_t n); ISO C++ #include <string.h> const void *memchr(const void *s, int c, size_t n); #include <cstring> void *std::memchr(void *s, int c, size_t n); DESCRIPTION
These functions operate as efficiently as possible on memory areas (arrays of bytes bounded by a count, not terminated by a null charac- ter). They do not check for the overflow of any receiving memory area. The memccpy() function copies bytes from memory area s2 into s1, stopping after the first occurrence of c (converted to an unsigned char) has been copied, or after n bytes have been copied, whichever comes first. It returns a pointer to the byte after the copy of c in s1, or a null pointer if c was not found in the first n bytes of s2. The memchr() function returns a pointer to the first occurrence of c (converted to an unsigned char) in the first n bytes (each interpreted as an unsigned char) of memory area s, or a null pointer if c does not occur. The memcmp() function compares its arguments, looking at the first n bytes (each interpreted as an unsigned char), and returns an integer less than, equal to, or greater than 0, according as s1 is lexicographically less than, equal to, or greater than s2 when taken to be unsigned characters. The memcpy() function copies n bytes from memory area s2 to s1. It returns s1. If copying takes place between objects that overlap, the behavior is undefined. The memmove() function copies n bytes from memory area s2 to memory area s1. Copying between objects that overlap will take place cor- rectly. It returns s1. The memset() function sets the first n bytes in memory area s to the value of c (converted to an unsigned char). It returns s. USAGE
Using memcpy() might be faster than using memmove() if the application knows that the objects being copied do not overlap. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Interface Stability |Standard | +-----------------------------+-----------------------------+ |MT-Level |MT-Safe | +-----------------------------+-----------------------------+ SEE ALSO
string(3C), attributes(5), standards(5) SunOS 5.10 1 Nov 2003 memory(3C)
All times are GMT -4. The time now is 01:19 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy