From nobody  Mon Jun 29 20:52:36 1998
Received: (from nobody@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id UAA20244;
          Mon, 29 Jun 1998 20:52:36 -0700 (PDT)
          (envelope-from nobody)
Message-Id: <199806300352.UAA20244@hub.freebsd.org>
Date: Mon, 29 Jun 1998 20:52:36 -0700 (PDT)
From: nick@taronga.com
To: freebsd-gnats-submit@freebsd.org
Subject: MAKEDEV vty<xy> doesn't check if the number <xy> is valid
X-Send-Pr-Version: www-1.0

>Number:         7124
>Category:       misc
>Synopsis:       [MFC] MAKEDEV (maybe awk) vty<xy> doesn't check if the number <xy> is valid
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    des
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jun 29 21:00:01 PDT 1998
>Closed-Date:    Mon Jul 6 03:59:31 PDT 1998
>Last-Modified:  Mon Jul  6 04:00:04 PDT 1998
>Originator:     Nick Manka
>Release:        2.2.5-6, 3.0-current
>Organization:
>Environment:
FreeBSD engylion.in.taronga.com 3.0-CURRENT FreeBSD 3.0-CURRENT #8: Sun Jun 28 06:52:55 CDT 1998     nick@engylion.in.taronga.com:/local/src/sys/compile/angelic  i386

>Description:
Supplying MAKEDEV with a vty number that is not a valid hexadecimal
number causes it to consume most of the processor time and all of
the memory on a machine.

I don't know if ever creates any devices, it never has for me before
consuming the entirety of 244 megabytes of memory and page space. When
run as a user not root, it waits for a few seconds and then says
"Out of space."

The bug appears to occur just below line 719 in MAKEDEV where

        units=`expr $i : 'vty\(.*\)'`
        eval `echo ${chr} ${units} | awk ' { c=$1; n=$2 } END {
                for (i = 0; i < n; i++)
                        printf("rm -f ttyv%01x; mknod ttyv%01x c %d %d; \  
                                chown root.wheel ttyv%01x;", \
                                i, i, c, i, i); }'`
        ln -fs ttyv0 vga        # XXX X still needs this pccons relic 
        ;;


splits off the number of devices to make and passes that to awk. I'm
not to keen with awk, but I'm under the impression that it can't deal
with a non-hexadecimal number where a hexadecimal number is supposed
to be.


>How-To-Repeat:
cd /dev
sh MAKEDEV vtyv4

vty<pretty much anything greater than ff> seems to do it.
>Fix:
Don't make typos as root :>

Have the awk script in MAKEDEV for vty* do a sanity check?

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->suspended 
State-Changed-By: phk 
State-Changed-When: Tue Jun 30 03:51:18 PDT 1998 
State-Changed-Why:  
awaiting committer 

From: smoergrd@oslo.geco-prakla.slb.com (Dag-Erling Coidan Smrgrav)
To: nick@taronga.com
Cc: freebsd-gnats-submit@freebsd.org
Subject: Re: misc/7124: MAKEDEV vty<xy> doesn't check if the number <xy> is valid
Date: 30 Jun 1998 15:37:50 +0200

 nick@taronga.com writes:
 > The bug appears to occur just below line 719 in MAKEDEV where
 > 
 >         units=`expr $i : 'vty\(.*\)'`
 >         eval `echo ${chr} ${units} | awk ' { c=$1; n=$2 } END {
 >                 for (i = 0; i < n; i++)
 >                         printf("rm -f ttyv%01x; mknod ttyv%01x c %d %d; \  
 >                                 chown root.wheel ttyv%01x;", \
 >                                 i, i, c, i, i); }'`
 >         ln -fs ttyv0 vga        # XXX X still needs this pccons relic 
 >         ;;
 > 
 > 
 > splits off the number of devices to make and passes that to awk. I'm
 > not to keen with awk, but I'm under the impression that it can't deal
 > with a non-hexadecimal number where a hexadecimal number is supposed
 > to be.
 
 The number supplied after "vty"in 'MAKEDEV vtyxx'is decimal, not
 hexadecimal. For instance, 'MAKEDEV vty16' will create device nodes
 for 16 vtys, named /dev/ttyv0 thru /dev/ttyvf.
 
 Anyway, the bug is due to the for loop never terminating because i < n
 is always true when n is a string:
 
 smoergrd@sunw132 ~$ echo | awk '{ if (1 < "one") { print "yes"; } }'
 yes
 
 The fix is to add 0 to n to force conversion to an integer:
 
 smoergrd@sunw132 ~$ echo | awk ' { if (1 < ("one"+0)) { print "yes"; } else { print "no"; } }'
 no
 
 In MAKEDEV, you'd replace the line with the eval with:
 
         eval `echo ${chr} ${units} | awk ' { c=$1; n=0+$2 } END {
 
 Below is a patch which (hopefully) fixes this problem in the two
 places I've been able to identify it in MAKEDEV. Due to the suckiness
 of my current Internet connection and my not having a FreeBSD box at
 hand (argh... why did I have to leave my laptop at home today?), I'll
 leave it to Somebody Else (tm) to test and commit it. The patch is
 against the following version of MAKEDEV:
 
      $Id: MAKEDEV,v 1.127.2.19 1998/03/01 22:20:11 steve Exp $
 
 which should be the most recent revision in the RELENG_2_2 branch.
 Adaptation to -current is left as an exercise to the reader.
 
 --- MAKEDEV.orig        Tue Jun 30 15:30:53 1998
 +++ MAKEDEV     Tue Jun 30 15:30:17 1998
 @@ -550,7 +550,7 @@
          case $class in
          0|1|2|3|4|5|6|7)
                  umask 0
 -                eval `echo $offset $name | awk ' { b=$1; n=$2 } END { \
 +                eval `echo $offset $name | awk ' { b=0+$1; n=0+$2 } END { \
                          for (i = 0; i < 32; i++) {
                                  c = substr("0123456789abcdefghijklmnopqrstuv", i + 1, 1); \
                                  printf("mknod tty%s%s c 5 %d; \
 @@ -712,7 +712,7 @@
  vty*)
          chr=12
          units=`expr $i : 'vty\(.*\)'`
 -        eval `echo ${chr} ${units} | awk ' { c=$1; n=$2 } END {
 +        eval `echo ${chr} ${units} | awk ' { c=0+$1; n=0+$2 } END {
                  for (i = 0; i < n; i++)
                          printf("mknod ttyv%01x c %d %d;", i, c, i); }'`
          ln -fs ttyv0 vga        # XXX X still needs this pccons relic
 
 DES
 -- 
 Dag-Erling Smrgrav - smoergrd@oslo.geco-prakla.slb.com
State-Changed-From-To: suspended->feedback 
State-Changed-By: des 
State-Changed-When: Thu Jul 2 00:58:12 PDT 1998 
State-Changed-Why:  
Fixed in current. 


Responsible-Changed-From-To: freebsd-bugs->des 
Responsible-Changed-By: des 
Responsible-Changed-When: Thu Jul 2 00:58:12 PDT 1998 
Responsible-Changed-Why:  
So I'll remember to MFC. 

From: smoergrd@oslo.geco-prakla.slb.com (Dag-Erling Coidan Smrgrav)
To: freebsd-gnats-submit@freebsd.org
Cc:  Subject: Re: misc/7124: MAKEDEV vty<xy> doesn't check if the number <xy> is valid
Date: 02 Jul 1998 09:59:12 +0200

 smoergrd@oslo.geco-prakla.slb.com (Dag-Erling Coidan Smrgrav) writes:
 >  Below is a patch which (hopefully) fixes this problem in the two
 >  places I've been able to identify it in MAKEDEV. Due to the suckiness
 >  of my current Internet connection and my not having a FreeBSD box at
 >  hand (argh... why did I have to leave my laptop at home today?), I'll
 >  leave it to Somebody Else (tm) to test and commit it.
 
 OK, you lazy slobs, I did it myself... Coming to a cvsup server near
 you within an hour or so.
 
 Now if somebody could please do the following on a scratch box:
 
 # cd /dev
 # rm ttyv*
 # ./MAKEDEV vtyzz
 # ls ttyv*
 (verify that no nodes were created)
 # ./MAKEDEV vty16
 # ls ttyv*
 (verify that 16 vty nodes were created)
 
 and tell me the results, I'd be mucho gratefulo. I've tested it on
 Helen and it seems to work, but you never know what I might have
 overlooked.
 
 BTW
 DES (a comitting waiter)
 -- 
 Dag-Erling Smrgrav - smoergrd@oslo.geco-prakla.slb.com
 
  Yeah, I know, I promised, but hey, it's in my bones...
State-Changed-From-To: feedback->closed 
State-Changed-By: des 
State-Changed-When: Mon Jul 6 03:59:31 PDT 1998 
State-Changed-Why:  
Merged into -stable. 
>Unformatted:
