linux-kernel - Re: [PATCH] core: dev: don't call BUG() on bad input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D591D04.4050000@gmail.com>
Date:	Mon, 14 Feb 2011 13:16:04 +0100
From:	Nicolas de Pesloüan 
	<nicolas.2p.debian@...il.com>
To:	Vasiliy Kulikov <segoon@...nwall.com>
CC:	linux-kernel@...r.kernel.org,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <eric.dumazet@...il.com>,
	Tom Herbert <therbert@...gle.com>,
	Changli Gao <xiaosuo@...il.com>,
	Jesse Gross <jesse@...ira.com>, netdev@...r.kernel.org
Subject: Re: [PATCH] core: dev: don't call BUG() on bad input

Le 14/02/2011 11:56, Vasiliy Kulikov a écrit :
> alloc_netdev() may be called with too long name (more that IFNAMSIZ bytes).
> Currently this leads to BUG().  Other insane inputs (bad txqs, rxqs) and
> even OOM don't lead to BUG().  Made alloc_netdev() return NULL, like on
> other errors.
>
> Signed-off-by: Vasiliy Kulikov<segoon@...nwall.com>
> ---
>   Compile tested.
>
>   net/core/dev.c |    5 ++++-
>   1 files changed, 4 insertions(+), 1 deletions(-)
>
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 6392ea0..12ef4b0 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -5761,7 +5761,10 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
>   	size_t alloc_size;
>   	struct net_device *p;
>
> -	BUG_ON(strlen(name)>= sizeof(dev->name));
> +	if (strnlen(name, sizeof(dev->name))>= sizeof(dev->name)) {

"size_t strnlen(const char *s, size_t maxlen) : The strnlen() function returns strlen(s), if that is 
less than maxlen, or maxlen if there is no '\0' character among the first maxlen characters pointed 
to by s."

How can strnlen(name, sizeof(dev->name)) be greater than sizeof(dev->name)?

Shouldn't it be "if (strnlen(name, sizeof(dev->name)) == sizeof(dev->name))" instead?

         Nicolas.

> +		pr_err("alloc_netdev: Too long device name \n");
> +		return NULL;
> +	}
>
>   	if (txqs<  1) {
>   		pr_err("alloc_netdev: Unable to allocate device "

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/