Hi @landley,
"mdev -s" iterates through /sys/class/ and /sys/block/ trying to find devices to add. The major:minor number is supposed to be read from the "dev" file (such as /sys/class/tty/console/dev):
int len=4;
char *dev = dirtree_path(node, &len);
strcpy(dev+len, "/dev");
if (!access(dev, R_OK)) make_device(dev);
This code fails because the len parameter returned by dirtree_path() is too large (len + 1, so 5 in this case). So the strcpy() writes outside the allocated buffer, which causes the make_device() to (fail to) read the wrong path and never add any devices.
Only acpi.c and mdev.c use the returned *plen value, but acpi.c uses it in a different way which I do not fully understand. The documentation only defines the value for a NULL pointer or a zero-values integer.
The fix in mdev.c is to replace the strcpy() with strcat(dev, "/dev"). Or to change dirtree_path() to return the length of the returned string, not its buffer size. Unfortunately, I cannot provide a patch for internal process reasons.
Best Regards
Hi @landley,
"mdev -s" iterates through /sys/class/ and /sys/block/ trying to find devices to add. The major:minor number is supposed to be read from the "dev" file (such as /sys/class/tty/console/dev):
This code fails because the len parameter returned by dirtree_path() is too large (len + 1, so 5 in this case). So the strcpy() writes outside the allocated buffer, which causes the make_device() to (fail to) read the wrong path and never add any devices.
Only acpi.c and mdev.c use the returned *plen value, but acpi.c uses it in a different way which I do not fully understand. The documentation only defines the value for a NULL pointer or a zero-values integer.
The fix in mdev.c is to replace the strcpy() with strcat(dev, "/dev"). Or to change dirtree_path() to return the length of the returned string, not its buffer size. Unfortunately, I cannot provide a patch for internal process reasons.
Best Regards