* [patch] netlink: fix a limit in NETLINK_LIST_MEMBERSHIPS
@ 2015-11-13 14:20 Dan Carpenter
2015-11-13 14:43 ` David Herrmann
0 siblings, 1 reply; 3+ messages in thread
From: Dan Carpenter @ 2015-11-13 14:20 UTC (permalink / raw)
To: David S. Miller, David Herrmann
Cc: Thomas Graf, Herbert Xu, Daniel Borkmann, Johannes Berg, Al Viro,
Nicolas Dichtel, Florian Westphal, netdev, kernel-janitors
This condition doesn't work when len is smaller than expected and not a
multiple of 4. In that situation "len - pos" is negative and type
promoted to a high unsigned value and we do not break out of the loop.
It causes the program calling it to crash.
Fixes: b42be38b2778 ('netlink: add API to retrieve all group memberships')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 59651af..76a8466 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2373,7 +2373,7 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
err = 0;
netlink_lock_table();
for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
- if (len - pos < sizeof(u32))
+ if (len < pos + sizeof(u32))
break;
idx = pos / sizeof(unsigned long);
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [patch] netlink: fix a limit in NETLINK_LIST_MEMBERSHIPS
2015-11-13 14:20 [patch] netlink: fix a limit in NETLINK_LIST_MEMBERSHIPS Dan Carpenter
@ 2015-11-13 14:43 ` David Herrmann
2015-11-13 19:53 ` Dan Carpenter
0 siblings, 1 reply; 3+ messages in thread
From: David Herrmann @ 2015-11-13 14:43 UTC (permalink / raw)
To: Dan Carpenter
Cc: David S. Miller, Thomas Graf, Herbert Xu, Daniel Borkmann,
Johannes Berg, Al Viro, Nicolas Dichtel, Florian Westphal, netdev,
kernel-janitors@vger.kernel.org
Hi
On Fri, Nov 13, 2015 at 3:20 PM, Dan Carpenter <dan.carpenter@oracle.com> wrote:
> This condition doesn't work when len is smaller than expected and not a
> multiple of 4. In that situation "len - pos" is negative and type
> promoted to a high unsigned value and we do not break out of the loop.
> It causes the program calling it to crash.
Could you give an example how this can happen? The loop-invariant
should be "len >= pos", as such, this shouldn't happen. "pos" starts
out as 0, "len" is guaranteed to be >=0. "pos" is only incremented by
4, if "len - pos >= 4".
What am I missing?
Thanks
David
> Fixes: b42be38b2778 ('netlink: add API to retrieve all group memberships')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
> index 59651af..76a8466 100644
> --- a/net/netlink/af_netlink.c
> +++ b/net/netlink/af_netlink.c
> @@ -2373,7 +2373,7 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
> err = 0;
> netlink_lock_table();
> for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
> - if (len - pos < sizeof(u32))
> + if (len < pos + sizeof(u32))
> break;
>
> idx = pos / sizeof(unsigned long);
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [patch] netlink: fix a limit in NETLINK_LIST_MEMBERSHIPS
2015-11-13 14:43 ` David Herrmann
@ 2015-11-13 19:53 ` Dan Carpenter
0 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2015-11-13 19:53 UTC (permalink / raw)
To: David Herrmann
Cc: David S. Miller, Thomas Graf, Herbert Xu, Daniel Borkmann,
Johannes Berg, Al Viro, Nicolas Dichtel, Florian Westphal, netdev,
kernel-janitors@vger.kernel.org
Oh. Crap... My mistake. Sorry for the noise. The original code is
fine.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-11-13 19:53 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-11-13 14:20 [patch] netlink: fix a limit in NETLINK_LIST_MEMBERSHIPS Dan Carpenter
2015-11-13 14:43 ` David Herrmann
2015-11-13 19:53 ` Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).