netdev - Re: [PATCH iproute2 v2 1/2] bpf: Fix segfault when custom pinning is used

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5a636d8d-e287-b553-b3fb-a62afbbde4ae@mojatatu.com>
Date:   Wed, 22 Apr 2020 13:19:01 -0400
From:   Jamal Hadi Salim <jhs@...atatu.com>
To:     Stephen Hemminger <stephen@...workplumber.org>
Cc:     netdev@...r.kernel.org, dsahern@...il.com, aclaudi@...hat.com,
        daniel@...earbox.net, asmadeus@...ewreck.org,
        Jamal Hadi Salim <hadi@...atatu.com>
Subject: Re: [PATCH iproute2 v2 1/2] bpf: Fix segfault when custom pinning is
 used

On 2020-04-22 12:35 p.m., Stephen Hemminger wrote:
> On Wed, 22 Apr 2020 06:28:07 -0400
> Jamal Hadi Salim <jhs@...atatu.com> wrote:
> 
>> From: Jamal Hadi Salim <hadi@...atatu.com>
>>
> 
> This is not a sufficient commit message. You need to describe what the
> problem is and why this fixes it.
> 
> 
>> Fixes: c0325b06382 ("bpf: replace snprintf with asprintf when dealing with long buffers")
>>
>> Signed-off-by: Jamal Hadi Salim <jhs@...atatu.com>
>> ---
>>   lib/bpf.c | 9 ++++-----
>>   1 file changed, 4 insertions(+), 5 deletions(-)
>>
>> diff --git a/lib/bpf.c b/lib/bpf.c
>> index 10cf9bf4..656cad02 100644
>> --- a/lib/bpf.c
>> +++ b/lib/bpf.c
>> @@ -1509,15 +1509,15 @@ out:
>>   static int bpf_make_custom_path(const struct bpf_elf_ctx *ctx,
>>   				const char *todo)
>>   {
>> -	char *tmp = NULL;
>> +	char tmp[PATH_MAX] = {};
> 
> Initializing the whole string to 0 is over kill here.

Why is it overkill? ;->
Note: I just replicated other parts of the same file which
initialize similar array to 0.

> 
>>   	char *rem = NULL;
>>   	char *sub;
>>   	int ret;
>>   
>> -	ret = asprintf(&tmp, "%s/../", bpf_get_work_dir(ctx->type));
>> +	ret = snprintf(tmp, PATH_MAX, "%s/../", bpf_get_work_dir(ctx->type));
> 
> snprintf will never return -1.

Man page says it does. Practically it may not but we have code (in
iproute2) which assumes it will happen.

Pick your poison:
1) Ignore the return code
2) As suggested by Dominique, something along the lines of:
if (ret <= 0 || ret >= MAX_PATH)
    ...error here..

Which one do you prefer?

cheers,
jamal