From: Jiri Pirko <jiri@resnulli.us>
To: Stephen Hemminger <stephen@networkplumber.org>
Cc: chrims@mellanox.com, netdev@vger.kernel.org,
sthemmin@microsoft.com, dsahern@gmail.com,
alexanderk@mellanox.com, mlxsw@mellanox.com
Subject: Re: [patch iproute2 1/2] tc: action: fix crash caused by incorrect *argv check
Date: Sat, 27 Jul 2019 10:36:03 +0200 [thread overview]
Message-ID: <20190727083603.GB2843@nanopsycho> (raw)
In-Reply-To: <20190726124707.2c53d6a4@hermes.lan>
Fri, Jul 26, 2019 at 09:47:07PM CEST, stephen@networkplumber.org wrote:
>On Tue, 23 Jul 2019 13:25:37 +0200
>Jiri Pirko <jiri@resnulli.us> wrote:
>
>> From: Jiri Pirko <jiri@mellanox.com>
>>
>> One cannot depend on *argv being null in case of no arg is left on the
>> command line. For example in batch mode, this is not always true. Check
>> argc instead to prevent crash.
>>
>> Reported-by: Alex Kushnarov <alexanderk@mellanox.com>
>> Fixes: fd8b3d2c1b9b ("actions: Add support for user cookies")
>> Signed-off-by: Jiri Pirko <jiri@mellanox.com>
>> ---
>> tc/m_action.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/tc/m_action.c b/tc/m_action.c
>> index ab6bc0ad28ff..0f9c3a27795d 100644
>> --- a/tc/m_action.c
>> +++ b/tc/m_action.c
>> @@ -222,7 +222,7 @@ done0:
>> goto bad_val;
>> }
>>
>> - if (*argv && strcmp(*argv, "cookie") == 0) {
>> + if (argc && strcmp(*argv, "cookie") == 0) {
>> size_t slen;
>>
>> NEXT_ARG();
>
>
>The logic here is broken at end of file.
>
> do {
> if (getcmdline(&line_next, &len, stdin) == -1)
> lastline = true;
>
> largc_next = makeargs(line_next, largv_next, 100);
> bs_enabled_next = batchsize_enabled(largc_next, largv_next);
> if (bs_enabled) {
> struct batch_
>
>
>getcmdline() will return -1 at end of file.
>The code will call make_args on an uninitialized pointer.
>
>I see lots of other unnecessary complexity in the whole batch logic.
>It needs to be rewritten.
>
>Rather than me fixing the code, I am probably going to revert.
I agree. This is a mess :(
>
>commit 485d0c6001c4aa134b99c86913d6a7089b7b2ab0
>Author: Chris Mi <chrism@mellanox.com>
>Date: Fri Jan 12 14:13:16 2018 +0900
>
> tc: Add batchsize feature for filter and actions
prev parent reply other threads:[~2019-07-27 8:36 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-23 11:25 [patch iproute2 1/2] tc: action: fix crash caused by incorrect *argv check Jiri Pirko
2019-07-23 11:25 ` [patch iproute2 2/2] tc: batch: fix line/line_next processing in batch Jiri Pirko
2019-07-26 21:35 ` Stephen Hemminger
2019-07-23 17:47 ` [patch iproute2 1/2] tc: action: fix crash caused by incorrect *argv check Stephen Hemminger
2019-07-23 17:54 ` Stephen Hemminger
2019-07-23 19:36 ` Jiri Pirko
2019-07-26 19:00 ` Stephen Hemminger
2019-07-24 9:07 ` David Laight
2019-07-26 19:47 ` Stephen Hemminger
2019-07-27 8:36 ` Jiri Pirko [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190727083603.GB2843@nanopsycho \
--to=jiri@resnulli.us \
--cc=alexanderk@mellanox.com \
--cc=chrims@mellanox.com \
--cc=dsahern@gmail.com \
--cc=mlxsw@mellanox.com \
--cc=netdev@vger.kernel.org \
--cc=stephen@networkplumber.org \
--cc=sthemmin@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).