From owner-freebsd-bugs  Thu Feb  6 06:10:09 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id GAA08101
          for bugs-outgoing; Thu, 6 Feb 1997 06:10:09 -0800 (PST)
Received: (from gnats@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id GAA08073;
          Thu, 6 Feb 1997 06:10:03 -0800 (PST)
Date: Thu, 6 Feb 1997 06:10:03 -0800 (PST)
Message-Id: <199702061410.GAA08073@freefall.freebsd.org>
To: freebsd-bugs
Cc: 
From: Mike Pritchard <mpp>
Subject: Re: bin/2676: modstat passes garbage name to kernel if name is not specified
Reply-To: Mike Pritchard <mpp>
Sender: owner-bugs@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

The following reply was made to PR bin/2676; it has been noted by GNATS.

From: Mike Pritchard <mpp>
To: gdonl@tsc.tdk.com
Cc: FreeBSD-gnats-submit@freebsd.org
Subject: Re: bin/2676: modstat passes garbage name to kernel if name is not specified
Date: Thu, 6 Feb 1997 06:00:17 -0800 (PST)

 Does this cause modstat to not work?  From examining the
 sources (3.0 and 2.2) to modstat, and the kernel, there should
 not be a need to ensure that lmc_stat.name is zeroed out.
 The ioctl should either be called with lmc_stat.id == -1
 and a module name properly set in lmc_stat.name, or it
 will be called with a lmc_stat.id >= 0 and lmc_stat.name
 will be ignored by the ioctl.
 
 Don Lewis wrote:
 > 
 > 
 > >Number:         2676
 > >Category:       bin
 > >Synopsis:       modstat passes garbage name to kernel if name is not specified
 > >Description:
 > 
 > 	If a module name is not specified on the command line for modstat,
 > 	it fails to initialize the name field of the lmc_stat structure
 > 	before passing this to the ioctl() call.  This results in whatever
 > 	random garbage is contained on the stack being used as the module
 > 	name.
 > 
 > 	This bug is present in all releases through -current.
 > 
 > >How-To-Repeat:
 > 
 > 	Run modstat without specifying a module name.
 > >Fix:
 > 	
 > 	Clear the sbuf.name[] array in dostat() with bzero() or equivalent
 > 	instead of just NUL terminating it.
 -- 
 Mike Pritchard
 mpp@FreeBSD.org
 "Go that way.  Really fast.  If something gets in your way, turn"