[FS#1425] iproute2: tc qdisc produces incorrect output

LEDE Bugs lede-bugs at lists.infradead.org
Sat Mar 10 08:10:58 PST 2018


The following task has a new comment added:

FS#1425 - iproute2: tc qdisc produces incorrect output
User who did this - Kevin Darbyshire-Bryant (kdarbyshirebryant)

----------
Right, cracked it and it’s horrible!

print_uint is expanded thus:  Note the type of value uint64_t

             void print_color_uint(enum output_type t, enum color_attr color, const char *key, const char *fmt, uint64_t value);
static inline void print_uint      (enum output_type t,                        const char *key, const char *fmt, uint64_t value)
                { print_color_uint(                 t, COLOR_NONE,                        key,             fmt,          value); };

So far so good.

print_color_uint expands to:

            void print_color_uint(enum output_type t, enum color_attr color, const char *key, const char *fmt, uint64_t value)
{
 if (((t & PRINT_JSON || t & PRINT_ANY) && _jw))
   { if (!key) jsonw_uint(_jw, value);
     else      jsonw_uint_field(_jw, key, value);
   }
 else if ((!_jw && (t & PRINT_FP || t & PRINT_ANY)))
   { color_fprintf( (stdout) , color, fmt, value);
   }
};

Again, no issue and we eventually call color_fprintf

int color_fprintf(FILE *fp, enum color_attr attr, const char *fmt, ...)
{
       int ret = 0;
       va_list args;

       va_start(args, fmt);

       if (!color_is_enabled || attr == COLOR_NONE) {
               ret = vfprintf(fp, fmt, args);
               goto end;
       }


Now, color_printf is a variable argument list function and as such is dependent upon being told the correct size of argument variables in the fmt variable.  And that’s our problem, we’re passing a 64bit integer but telling the format string that it’s ‘int’…which I’m guessing can be variable sizes depending on architecture, as can the endianness.

If we instead do (in q_cake.c)

#include 

print_uint(PRINT_ANY, "min_transport_size", " min/max transport layer size: %10" PRIu64, stnc->min_trnlen);

it works.  This needs sanity checking by a clever person.
----------

More information can be found at the following URL:
https://bugs.openwrt.org/index.php?do=details&task_id=1425#comment4450



More information about the lede-bugs mailing list