namespaces: Out-of-bounds array access

namespaces: Out-of-bounds array access

[Richard Weinberger]

[-- Attachment #1: Type: text/plain, Size: 268 bytes --]

Hi!

While searching a completely different bug I've found this problem:
If CONFIG_NET_NS, CONFIG_UTS_NS and CONFIG_IPC_NS are disabled, ns_entries[]
becomes empty and things like ns_entries[ARRAY_SIZE(ns_entries) - 1] will explode.

Thanks,
//richard





[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 490 bytes --]

Re: namespaces: Out-of-bounds array access

[Andrew Morton]

On Fri, 06 Jan 2012 01:18:47 +0100
Richard Weinberger <richard@nod.at> wrote:

> Hi!
> 
> While searching a completely different bug I've found this problem:
> If CONFIG_NET_NS, CONFIG_UTS_NS and CONFIG_IPC_NS are disabled, ns_entries[]
> becomes empty and things like ns_entries[ARRAY_SIZE(ns_entries) - 1] will explode.
> 

Presumably this will fix it:

--- a/fs/proc/namespaces.c~a
+++ a/fs/proc/namespaces.c
@@ -156,15 +156,15 @@ static struct dentry *proc_ns_dir_lookup
 	if (!ptrace_may_access(task, PTRACE_MODE_READ))
 		goto out;
 
-	last = &ns_entries[ARRAY_SIZE(ns_entries) - 1];
-	for (entry = ns_entries; entry <= last; entry++) {
+	last = &ns_entries[ARRAY_SIZE(ns_entries)];
+	for (entry = ns_entries; entry < last; entry++) {
 		if (strlen((*entry)->name) != len)
 			continue;
 		if (!memcmp(dentry->d_name.name, (*entry)->name, len))
 			break;
 	}
 	error = ERR_PTR(-ENOENT);
-	if (entry > last)
+	if (entry == last)
 		goto out;
 
 	error = proc_ns_instantiate(dir, dentry, task, *entry);
_

But I wonder why we compile this file at all when ns_entries[] is
empty?