Skip to contentSkip to conversation

isdn/gigaset: off by one check leading to oops

PATCH In review Dan Carpenter 2 participants 3 messages Jan 17, 2013 – Jan 18, 2013

Subsystems (3)
Networking Network drivers Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 isdn/gigaset: off by one check leading to oops

If l = 12 then later we subtract 12 leaving zero. We do a zero size allocation, so "dbgline" points to the ZERO_SIZE_PTR. It leads to an oops when we set the NUL terminator:

	dbgline[3 * l - 1] = '\0';
Signed-off-by Dan Carpenter <[email protected]>

---
Static analysis stuff.

drivers/isdn/gigaset/capi.c +1 -1
index 68452b7..0d34325 100644
@@ -239,7 +239,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
 		return;
 
 	l = CAPIMSG_LEN(data);
-	if (l < 12) {
+	if (l <= 12) {
 		gig_dbg(level, "%s: ??? LEN=%04d", tag, l);
 		return;
 	}
#1 lore raw

Hi Dan,

Am 17.01.2013 08:44, schrieb Dan Carpenter:

Quoted 4 lines

If l == 12 then later we subtract 12 leaving zero. We do a zero size allocation, so "dbgline" points to the ZERO_SIZE_PTR. It leads to an oops when we set the NUL terminator:

	dbgline[3 * l - 1] = '\0';

thanks for finding that bug, but NAK to your fix.

drivers/isdn/gigaset/capi.c static inline void dump_rawmsg(enum debuglevel level, const char *tag, · line 245

Quoted 9 lines
drivers/isdn/gigaset/capi.c +1 -1
@@ -239,7 +239,7 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
 		return;
 
 	l = CAPIMSG_LEN(data);
-	if (l < 12) {
+	if (l <= 12) {
 		gig_dbg(level, "%s: ??? LEN=%04d", tag, l);
 		return;
 	}

CAPI messages of exactly 12 bytes are legal, and should be decoded with the regular gig_dbg() call immediately after that hunk. It's just the hex dump part that should be skipped in that case. So I'd prefer to have it fixed this way instead:

@@ -248,6 +248,8 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,

                CAPIMSG_APPID(data), CAPIMSG_MSGID(data), l,
                CAPIMSG_CONTROL(data));
        l -= 12;
+       if (l <= 0)
+               return;
        dbgline = kmalloc(3 * l, GFP_ATOMIC);
        if (!dbgline)
                return;

I'll prepare a patch of my own, citing you as reporter, if that's ok with you.

Thanks,
Tilman

Signature · 4 lines
Tilman Schmidt                    E-Mail: [email protected]
Bonn, Germany
Diese Nachricht besteht zu 100% aus wiederverwerteten Bits.
Ungeöffnet mindestens haltbar bis: (siehe Rückseite)
author
#2 lore raw
Quoted 3 lines · Tilman Schmidt

I'll prepare a patch of my own, citing you as reporter, if that's ok with you.

That sounds great.

regards,
dan carpenter