[patch] netstat: got bogus unix line...

Denys Vlasenko vda.linux at googlemail.com
Wed Dec 26 22:54:18 UTC 2007


On Wednesday 26 December 2007 22:37, Loïc Grenié wrote:
> 2007/12/26, Denys Vlasenko <vda.linux at googlemail.com>:
> > On Wednesday 26 December 2007 20:42, Cristian Ionescu-Idbohrn wrote:
> > > On Wed, 26 Dec 2007, Denys Vlasenko wrote:
> > > > On Tuesday 25 December 2007 16:34, Cristian Ionescu-Idbohrn wrote:
> > > > > Yes.  But it's too big.  Let's see if attached few lines of
> > > > > /proc/net/unix will suffice.
> > > >
> > > > This line is especially ugly:
> > > >
> > > > f7ab6280: 00000002 00000000 00000000 0002 01 14954 @^@^@^@.^R^@^@x*
> > >
> > > Yes, it is.
> > >
> > > > I think you have to retest it with latest kernel and if it happens
> > > > there too, report the bug to kernel mailing list.
> > >
> > > This may arguably be a kernel problem.  As the comment in the
> > > bb-netstat says, and which I quoted in my previous post, socket names
> > > as this one did show up in 2.6 /proc files for as long as I remember.
> >
> > I added that comment, not long ago.
> >
> > > IMO, this is more like an application bug.
> >
> > Are you saying it's ok for kernel to dump random binary crap
> > through /proc/net/unix?
>
>     I might be wrong, but it that random binary crap happens to be the
>   name of the socket, I don't know what the kernel can do (except
>   dump it through /proc/net/unix). There is indeed a problem because
>   the name can contain an eol character and it's difficult to treat this
>   case (cracker beware).

Christian sees the following /proc/net/unix:

f425d100: 00000002 00000000 00010000 0001 01 14216 private/scalemail-backend
f421d980: 00000002 00000000 00010000 0001 01 14220 private/mailman
f7ab6280: 00000002 00000000 00000000 0002 01 14954 @^@^@^@.^R^@^@x*
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
f42f0980: 00000002 00000000 00010000 0001 01 14164 private/relay
dfa74500: 0000001B 00000000 00000000 0002 01 12614 /dev/log
f3c5da80: 00000002 00000000 00010000 0001 01 13133 /var/run/dbus/system_bus_socket

Names like @ NUL NUL NUL . Ctrl-R NUL NUL x *
are sure as hell are not correct UNIX domain socket names,
wouldn't you agree?
--
vda





More information about the busybox mailing list