RE: [stable] [patch 37/37] sit: fix off-by-one inipip6_tunnel_get_prl

Templin, Fred L
2009-10-13T01:40:15Z

Greg,

> -----Original Message-----
> From: Greg KH [mailto:greg@kroah.com]
> Sent: Monday, October 12, 2009 3:05 PM
> To: David Miller
> Cc: Templin, Fred L; contact@saschahlusiak.de; yoshfuji@linux-ipv6.org; gregkh@suse.de; linux-
> kernel@vger.kernel.org; stable@kernel.org; akpm@linux-foundation.org; torvalds@linux-foundation.org;
> stable-review@kernel.org; alan@lxorguk.ukuu.org.uk
> Subject: Re: [stable] [patch 37/37] sit: fix off-by-one inipip6_tunnel_get_prl
>
> On Fri, Oct 09, 2009 at 08:42:31PM -0700, David Miller wrote:
> > From: "Templin, Fred L" <Fred.L.Templin@boeing.com>
> > Date: Fri, 9 Oct 2009 17:34:49 -0700
> >
> > > Wait a moment - I remember now that this code came
> > > from Yoshifuji, and I believe there was a reason for
> > > the cmax+1. The application is expected to know this
> > > and to post a large enough buffer.
> > >
> > > Can we put this on hold until I have had a chance to
> > > check my e-mail archives and my local iproute changes
> > > (will respond on monday)?
> >
> > Sure, we can keep it out of -stable for now.
> >
> > But it is in Linus's tree so if you find we shouldn't do this
> > you'll need to send me a revert for net-2.6
> >
> > Otherwise if it's good, you'll have to remind me to resubmit
> > it to -stable.
>
> Ah crap, I just commited it.
>
> Is it really broken? If so, I'll go revert it and cut a new release.
>
> Sorry about this.

As I just mentioned to David, I tested and the patch is
good. To test, I allocated a buffer in the application
that was too small to hold the entire PRL. Without the
patch, the system crashes. With the patch, the kernel
returns the maximum number of PRL entries without
crashing and without overrunning the application's buffer.

Please apply the patch if you have not already done so.

Fred
fred.l.templin@boeing.com

> greg k-h