netdev - Re: [PATCH net-next 4/6] net: trust the bitmap in __dev_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZTJYpx5dn4UPa2/j@nanopsycho>
Date: Fri, 20 Oct 2023 12:38:31 +0200
From: Jiri Pirko <jiri@...nulli.us>
To: Jakub Kicinski <kuba@...nel.org>
Cc: davem@...emloft.net, netdev@...r.kernel.org, edumazet@...gle.com,
	pabeni@...hat.com, johannes.berg@...el.com, mpe@...erman.id.au,
	j@...fi
Subject: Re: [PATCH net-next 4/6] net: trust the bitmap in __dev_alloc_name()

Fri, Oct 20, 2023 at 03:18:54AM CEST, kuba@...nel.org wrote:
>Prior to restructuring __dev_alloc_name() handled both printf
>and non-printf names. In a clever attempt at code reuse it
>always prints the name into a buffer and checks if it's
>a duplicate.
>
>Trust the bitmap, and return an error if its full.
>
>Signed-off-by: Jakub Kicinski <kuba@...nel.org>
>---
> net/core/dev.c | 15 ++++-----------
> 1 file changed, 4 insertions(+), 11 deletions(-)
>
>diff --git a/net/core/dev.c b/net/core/dev.c
>index bbfb02b4a228..d2698b4bbad4 100644
>--- a/net/core/dev.c
>+++ b/net/core/dev.c
>@@ -1119,18 +1119,11 @@ static int __dev_alloc_name(struct net *net, const char *name, char *res)
> 
> 	i = find_first_zero_bit(inuse, max_netdevices);
> 	bitmap_free(inuse);
>+	if (i == max_netdevices)
>+		return -ENFILE;

Hmm, aren't you changeing functionality here? I mean, prior to this
patch, the i of value "max_netdevices" was happily used, wan't it?
In theory it may break things allowing n-1 netdevices of a name instead
of n.


> 
>-	snprintf(buf, IFNAMSIZ, name, i);
>-	if (!netdev_name_in_use(net, buf)) {
>-		strscpy(res, buf, IFNAMSIZ);
>-		return i;
>-	}
>-
>-	/* It is possible to run out of possible slots
>-	 * when the name is long and there isn't enough space left
>-	 * for the digits, or if all bits are used.
>-	 */
>-	return -ENFILE;
>+	snprintf(res, IFNAMSIZ, name, i);
>+	return i;
> }
> 
> /* Returns negative errno or allocated unit id (see __dev_alloc_name()) */
>-- 
>2.41.0
>