Bug 286041 – Bad usage of ioctl() in sys-fs/udev-146 causes spurious errors on amd64

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Andrew Church 2009-09-23 03:27:04 UTC]

A bad parameter type to an ioctl() call causes udev-146 to generate "error getting buffer for inotify" messages in syslog.  The offending code is roughly:

    ssize_t nbytes, pos;
    // ...
    ioctl(fd, FIONREAD, &nbytes);

where ssize_t is 64 bits on amd64, but the kernel code for FIONREAD (at least through gentoo-sources-2.6.31) uses type int:

    p = (void __user *) arg;
    switch (cmd) {
    case FIONREAD:
        // ...
        ret = put_user(send_len, (int __user *) p);

so the upper 32 bits of "nbytes" are left uninitialized, and the subsequent malloc(nbytes) fails unless those 32 bits happen to be zero (or the system has a LOT of memory).

Patch will follow.

[Comment 1 Andrew Church 2009-09-23 03:30:00 UTC]

Created attachment 204988 [details, diff]
Fix for incorrect ioctl() parameter type

I'm assuming the use of int instead of [s]size_t in the kernel is intentional, since all the FIONREAD handlers seem to use int.

[Comment 2 Rafał Mużyło 2009-09-23 20:32:35 UTC]

*** Bug 285941 has been marked as a duplicate of this bug. ***

[Comment 3 Rafał Mużyło 2009-09-23 20:34:41 UTC]

*** Bug 285050 has been marked as a duplicate of this bug. ***

[Comment 4 Matthias Schwarzott 2009-10-02 11:41:26 UTC]

Fixed in udev-145-r3 and udev-146-r1.