Skip to contentSkip to conversation

netfilter: nfnetlink_hook: fix check for snprintf() overflow

PATCH Applied Dan Carpenter 3 participants 3 messages Jun 19, 2021 – Jun 21, 2021

Subsystems (4)
Networking Network drivers Kernel janitors netfilter
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 netfilter: nfnetlink_hook: fix check for snprintf() overflow

The kernel version of snprintf() can't return negatives. The "ret > (int)sizeof(sym)" check is off by one because and it should be

Quoted 1 line

=. Finally, we need to set a negative error code.

Fixes e2cf17d3774c ("netfilter: add new hook nfnl subsystem")
Signed-off-by Dan Carpenter <[email protected]>
---
 net/netfilter/nfnetlink_hook.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nfnetlink_hook.c +3 -1
index 58fda6ac663b..50b4e3c9347a 100644
@@ -126,8 +126,10 @@ static int nfnl_hook_dump_one(struct sk_buff *nlskb,
 
 #ifdef CONFIG_KALLSYMS
 	ret = snprintf(sym, sizeof(sym), "%ps", ops->hook);
-	if (ret < 0 || ret > (int)sizeof(sym))
+	if (ret >= sizeof(sym)) {
+		ret = -EINVAL;
 		goto nla_put_failure;
+	}
 
 	module_name = strstr(sym, " [");
 	if (module_name) {
Signature · 1 line
2.30.2
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 3 lines · Dan Carpenter

The kernel version of snprintf() can't return negatives. The "ret > (int)sizeof(sym)" check is off by one because and it should be

Quoted 1 line

=. Finally, we need to set a negative error code.

Reviewed-by Florian Westphal <[email protected]>
maintainer Applied
#2 lore raw
In reply to Dan Carpenter
Quoted 3 lines · Dan Carpenter

The kernel version of snprintf() can't return negatives. The "ret > (int)sizeof(sym)" check is off by one because and it should be

Quoted 1 line

=. Finally, we need to set a negative error code.

Applied, thanks.