Skip to contentSkip to conversation

net/sched: potential data corruption

PATCH Applied Dan Carpenter 3 participants 3 messages Jul 13, 2010 – Jul 15, 2010

Subsystems (4)
Networking Network drivers Kernel janitors Traffic control (tc)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 net/sched: potential data corruption

The reset_policy() does:

        memset(d->tcfd_defdata, 0, SIMP_MAX_DATA);
        strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);

In the original code, the size of d->tcfd_defdata wasn't fixed and if strlen(defdata) was less than 31, reset_policy() would cause memory corruption.

Please Note: The original alloc_defdata() assumes defdata is 32 characters and a NUL terminator while reset_policy() assumes defdata is 31 characters and a NUL. This patch updates alloc_defdata() to match reset_policy() (ie a shorter string). I'm not very familiar with this code so please review carefully.

Signed-off-by Dan Carpenter <[email protected]>
net/sched/act_simple.c +2 -2
index 1b4bc69..4a1d640 100644
@@ -73,10 +73,10 @@ static int tcf_simp_release(struct tcf_defact *d, int bind)
 
 static int alloc_defdata(struct tcf_defact *d, char *defdata)
 {
-	d->tcfd_defdata = kstrndup(defdata, SIMP_MAX_DATA, GFP_KERNEL);
+	d->tcfd_defdata = kzalloc(SIMP_MAX_DATA, GFP_KERNEL);
 	if (unlikely(!d->tcfd_defdata))
 		return -ENOMEM;
-
+	strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
 	return 0;
 }
Acked-by on v1 1/1
#1 lore raw
Quoted 8 lines · Dan Carpenter

The reset_policy() does:

        memset(d->tcfd_defdata, 0, SIMP_MAX_DATA);
        strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);

In the original code, the size of d->tcfd_defdata wasn't fixed and if strlen(defdata) was less than 31, reset_policy() would cause memory corruption.

Quoted 7 lines

Please Note: The original alloc_defdata() assumes defdata is 32 characters and a NUL terminator while reset_policy() assumes defdata is 31 characters and a NUL. This patch updates alloc_defdata() to match reset_policy() (ie a shorter string). I'm not very familiar with this code so please review carefully.

Signed-off-by Dan Carpenter <[email protected]>
Acked-by Jamal Hadi Salim <[email protected]>

cheers,
jamal

maintainer Applied
#2 lore raw

From: jamal <[email protected]>
Date: Tue, 13 Jul 2010 11:58:14 -0400

Quoted 15 lines · Dan Carpenter
Quoted 14 lines

The reset_policy() does:

        memset(d->tcfd_defdata, 0, SIMP_MAX_DATA);
        strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);

In the original code, the size of d->tcfd_defdata wasn't fixed and if strlen(defdata) was less than 31, reset_policy() would cause memory corruption.

Please Note: The original alloc_defdata() assumes defdata is 32 characters and a NUL terminator while reset_policy() assumes defdata is 31 characters and a NUL. This patch updates alloc_defdata() to match reset_policy() (ie a shorter string). I'm not very familiar with this code so please review carefully.

Quoted 4 lines
Quoted 1 line
Signed-off-by Dan Carpenter <[email protected]>
Acked-by Jamal Hadi Salim <[email protected]>

Applied, thanks.