* [PATCH] bonding: fix off-by-one error
@ 2012-10-31 14:42 Nikolay Aleksandrov
2012-10-31 16:03 ` [PATCH] bonding: fix second " Nikolay Aleksandrov
2012-11-01 15:54 ` [PATCH] bonding: fix " David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Nikolay Aleksandrov @ 2012-10-31 14:42 UTC (permalink / raw)
To: netdev; +Cc: andy, fubar
Fix off-by-one error because IFNAMSIZ == 16 and when this
code gets executed we stick a NULL byte where we should not.
How to reproduce:
with CONFIG_CC_STACKPROTECTOR=y (otherwise it may pass by silently)
modprobe bonding; echo 1 > /sys/class/net/bond0/bonding/mode;
echo "AAAAAAAAAAAAAAAA" > /sys/class/net/bond0/bonding/primary;
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
---
drivers/net/bonding/bond_sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index dc15d24..238d9b3 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1060,7 +1060,7 @@ static ssize_t bonding_store_primary(struct device *d,
goto out;
}
- sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
+ sscanf(buf, "%15s", ifname); /* IFNAMSIZ */
/* check to see if we are clearing primary */
if (!strlen(ifname) || buf[0] == '\n') {
--
1.7.11.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH] bonding: fix second off-by-one error
2012-10-31 14:42 [PATCH] bonding: fix off-by-one error Nikolay Aleksandrov
@ 2012-10-31 16:03 ` Nikolay Aleksandrov
2012-11-01 15:54 ` [PATCH] bonding: fix " David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Nikolay Aleksandrov @ 2012-10-31 16:03 UTC (permalink / raw)
To: netdev; +Cc: andy, fubar
Fix off-by-one error because IFNAMSIZ == 16 and when this
code gets executed we stick a NULL byte where we should not.
How to reproduce:
with CONFIG_CC_STACKPROTECTOR=y (otherwise it may pass by silently)
modprobe bonding; echo 1 > /sys/class/net/bond0/bonding/mode;
echo "AAAAAAAAAAAAAAAA" > /sys/class/net/bond0/bonding/active_slave;
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Note: Sorry for the second patch but I missed this one while checking
the file. You can squash them into one patch.
---
drivers/net/bonding/bond_sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 238d9b3..ef8d2a0 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1237,7 +1237,7 @@ static ssize_t bonding_store_active_slave(struct device *d,
goto out;
}
- sscanf(buf, "%16s", ifname); /* IFNAMSIZ */
+ sscanf(buf, "%15s", ifname); /* IFNAMSIZ */
/* check to see if we are clearing active */
if (!strlen(ifname) || buf[0] == '\n') {
--
1.7.11.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] bonding: fix off-by-one error
2012-10-31 14:42 [PATCH] bonding: fix off-by-one error Nikolay Aleksandrov
2012-10-31 16:03 ` [PATCH] bonding: fix second " Nikolay Aleksandrov
@ 2012-11-01 15:54 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2012-11-01 15:54 UTC (permalink / raw)
To: nikolay; +Cc: netdev, andy, fubar
From: Nikolay Aleksandrov <nikolay@redhat.com>
Date: Wed, 31 Oct 2012 15:42:51 +0100
> Fix off-by-one error because IFNAMSIZ == 16 and when this
> code gets executed we stick a NULL byte where we should not.
>
> How to reproduce:
> with CONFIG_CC_STACKPROTECTOR=y (otherwise it may pass by silently)
> modprobe bonding; echo 1 > /sys/class/net/bond0/bonding/mode;
> echo "AAAAAAAAAAAAAAAA" > /sys/class/net/bond0/bonding/primary;
>
> Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
I've applied both of your patches, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-11-01 15:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-10-31 14:42 [PATCH] bonding: fix off-by-one error Nikolay Aleksandrov
2012-10-31 16:03 ` [PATCH] bonding: fix second " Nikolay Aleksandrov
2012-11-01 15:54 ` [PATCH] bonding: fix " David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).