From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: coreteam@netfilter.org, netdev@vger.kernel.org,
bridge@lists.linux-foundation.org,
kernel-janitors@vger.kernel.org,
"David S. Miller" <davem@davemloft.net>,
Stephen Hemminger <stephen@networkplumber.org>,
netfilter@vger.kernel.org,
Bart De Schuymer <bart.de.schuymer@pandora.be>,
netfilter-devel@vger.kernel.org,
Patrick McHardy <kaber@trash.net>
Subject: Re: [Bridge] [patch] netfilter: prevent harmless integer overflow
Date: Thu, 20 Jun 2013 12:23:52 +0200 [thread overview]
Message-ID: <20130620102352.GA19813@localhost> (raw)
In-Reply-To: <20130618074603.GF12329@elgon.mountain>
On Tue, Jun 18, 2013 at 10:46:03AM +0300, Dan Carpenter wrote:
> This overflow is harmless because a few lines later we check:
>
> if (num_counters != t->private->nentries) {
>
> But it still upsets the static checkers.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
> index 3d110c4..141350e 100644
> --- a/net/bridge/netfilter/ebtables.c
> +++ b/net/bridge/netfilter/ebtables.c
> @@ -1278,6 +1278,8 @@ static int do_update_counters(struct net *net, const char *name,
>
> if (num_counters == 0)
> return -EINVAL;
> + if (num_counters > INT_MAX / sizeof(*tmp))
> + return -ENOMEM;
This is artificially limiting to INT_MAX / sizeof(struct counters).
Before this patch, the limit is UINT_MAX / sizeof(struct counters). I
think it's very unlikely to hit such a limit though, but as you
mentioned we cover the overflow already. Adding it to calm down a
static checker sound a bit too much for me.
WARNING: multiple messages have this Message-ID (diff)
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Bart De Schuymer <bart.de.schuymer@pandora.be>,
Patrick McHardy <kaber@trash.net>,
Stephen Hemminger <stephen@networkplumber.org>,
"David S. Miller" <davem@davemloft.net>,
netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org,
coreteam@netfilter.org, bridge@lists.linux-foundation.org,
netdev@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [patch] netfilter: prevent harmless integer overflow
Date: Thu, 20 Jun 2013 10:23:52 +0000 [thread overview]
Message-ID: <20130620102352.GA19813@localhost> (raw)
In-Reply-To: <20130618074603.GF12329@elgon.mountain>
On Tue, Jun 18, 2013 at 10:46:03AM +0300, Dan Carpenter wrote:
> This overflow is harmless because a few lines later we check:
>
> if (num_counters != t->private->nentries) {
>
> But it still upsets the static checkers.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
> index 3d110c4..141350e 100644
> --- a/net/bridge/netfilter/ebtables.c
> +++ b/net/bridge/netfilter/ebtables.c
> @@ -1278,6 +1278,8 @@ static int do_update_counters(struct net *net, const char *name,
>
> if (num_counters = 0)
> return -EINVAL;
> + if (num_counters > INT_MAX / sizeof(*tmp))
> + return -ENOMEM;
This is artificially limiting to INT_MAX / sizeof(struct counters).
Before this patch, the limit is UINT_MAX / sizeof(struct counters). I
think it's very unlikely to hit such a limit though, but as you
mentioned we cover the overflow already. Adding it to calm down a
static checker sound a bit too much for me.
WARNING: multiple messages have this Message-ID (diff)
From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Bart De Schuymer <bart.de.schuymer@pandora.be>,
Patrick McHardy <kaber@trash.net>,
Stephen Hemminger <stephen@networkplumber.org>,
"David S. Miller" <davem@davemloft.net>,
netfilter-devel@vger.kernel.org, netfilter@vger.kernel.org,
coreteam@netfilter.org, bridge@lists.linux-foundation.org,
netdev@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [patch] netfilter: prevent harmless integer overflow
Date: Thu, 20 Jun 2013 12:23:52 +0200 [thread overview]
Message-ID: <20130620102352.GA19813@localhost> (raw)
In-Reply-To: <20130618074603.GF12329@elgon.mountain>
On Tue, Jun 18, 2013 at 10:46:03AM +0300, Dan Carpenter wrote:
> This overflow is harmless because a few lines later we check:
>
> if (num_counters != t->private->nentries) {
>
> But it still upsets the static checkers.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
> index 3d110c4..141350e 100644
> --- a/net/bridge/netfilter/ebtables.c
> +++ b/net/bridge/netfilter/ebtables.c
> @@ -1278,6 +1278,8 @@ static int do_update_counters(struct net *net, const char *name,
>
> if (num_counters == 0)
> return -EINVAL;
> + if (num_counters > INT_MAX / sizeof(*tmp))
> + return -ENOMEM;
This is artificially limiting to INT_MAX / sizeof(struct counters).
Before this patch, the limit is UINT_MAX / sizeof(struct counters). I
think it's very unlikely to hit such a limit though, but as you
mentioned we cover the overflow already. Adding it to calm down a
static checker sound a bit too much for me.
next prev parent reply other threads:[~2013-06-20 10:23 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-18 7:46 [Bridge] [patch] netfilter: prevent harmless integer overflow Dan Carpenter
2013-06-18 7:46 ` Dan Carpenter
2013-06-18 7:46 ` Dan Carpenter
2013-06-20 10:23 ` Pablo Neira Ayuso [this message]
2013-06-20 10:23 ` Pablo Neira Ayuso
2013-06-20 10:23 ` Pablo Neira Ayuso
2013-06-20 11:09 ` [Bridge] " Dan Carpenter
2013-06-20 11:09 ` Dan Carpenter
2013-06-20 11:09 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130620102352.GA19813@localhost \
--to=pablo@netfilter.org \
--cc=bart.de.schuymer@pandora.be \
--cc=bridge@lists.linux-foundation.org \
--cc=coreteam@netfilter.org \
--cc=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=kaber@trash.net \
--cc=kernel-janitors@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=netfilter@vger.kernel.org \
--cc=stephen@networkplumber.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.