| Message ID | 1297680967-11893-1-git-send-email-segoon@openwall.com |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Miller |
| Headers | show |
Le 14/02/2011 11:56, Vasiliy Kulikov a écrit : > alloc_netdev() may be called with too long name (more that IFNAMSIZ bytes). > Currently this leads to BUG(). Other insane inputs (bad txqs, rxqs) and > even OOM don't lead to BUG(). Made alloc_netdev() return NULL, like on > other errors. > > Signed-off-by: Vasiliy Kulikov<segoon@openwall.com> > --- > Compile tested. > > net/core/dev.c | 5 ++++- > 1 files changed, 4 insertions(+), 1 deletions(-) > > diff --git a/net/core/dev.c b/net/core/dev.c > index 6392ea0..12ef4b0 100644 > --- a/net/core/dev.c > +++ b/net/core/dev.c > @@ -5761,7 +5761,10 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, > size_t alloc_size; > struct net_device *p; > > - BUG_ON(strlen(name)>= sizeof(dev->name)); > + if (strnlen(name, sizeof(dev->name))>= sizeof(dev->name)) { "size_t strnlen(const char *s, size_t maxlen) : The strnlen() function returns strlen(s), if that is less than maxlen, or maxlen if there is no '\0' character among the first maxlen characters pointed to by s." How can strnlen(name, sizeof(dev->name)) be greater than sizeof(dev->name)? Shouldn't it be "if (strnlen(name, sizeof(dev->name)) == sizeof(dev->name))" instead? Nicolas. > + pr_err("alloc_netdev: Too long device name \n"); > + return NULL; > + } > > if (txqs< 1) { > pr_err("alloc_netdev: Unable to allocate device " -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Hi Nicolas, On Mon, Feb 14, 2011 at 13:16 +0100, Nicolas de Pesloüan wrote: > >- BUG_ON(strlen(name)>= sizeof(dev->name)); > >+ if (strnlen(name, sizeof(dev->name))>= sizeof(dev->name)) { Ehh... Space after ")" is needed :) > "size_t strnlen(const char *s, size_t maxlen) : The strnlen() > function returns strlen(s), if that is less than maxlen, or maxlen > if there is no '\0' character among the first maxlen characters > pointed to by s." > > How can strnlen(name, sizeof(dev->name)) be greater than sizeof(dev->name)? > > Shouldn't it be "if (strnlen(name, sizeof(dev->name)) == sizeof(dev->name))" instead? Not a big deal, but MO it's better to guard from everything that is not a good input by negating the check. strnlen() < sizeof() is OK, strnlen() >= sizeof() is bad. Is "==" more preferable for net/ coding style?
Le 14/02/2011 13:23, Vasiliy Kulikov a écrit : > Hi Nicolas, Hi Vasiliy, > On Mon, Feb 14, 2011 at 13:16 +0100, Nicolas de Pesloüan wrote: >>> - BUG_ON(strlen(name)>= sizeof(dev->name)); >>> + if (strnlen(name, sizeof(dev->name))>= sizeof(dev->name)) { > > Ehh... Space after ")" is needed :) :-D >> "size_t strnlen(const char *s, size_t maxlen) : The strnlen() >> function returns strlen(s), if that is less than maxlen, or maxlen >> if there is no '\0' character among the first maxlen characters >> pointed to by s." >> >> How can strnlen(name, sizeof(dev->name)) be greater than sizeof(dev->name)? >> >> Shouldn't it be "if (strnlen(name, sizeof(dev->name)) == sizeof(dev->name))" instead? > > Not a big deal, but MO it's better to guard from everything that > is not a good input by negating the check. strnlen()< sizeof() is OK, > strnlen()>= sizeof() is bad. Is "==" more preferable for net/ coding style? Agreed, both cannot cause any troubles. == is supposed to be better from the API point of view, but >= is probably more readable. Nicolas. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, 14 Feb 2011 13:56:06 +0300 Vasiliy Kulikov <segoon@openwall.com> wrote: > alloc_netdev() may be called with too long name (more that IFNAMSIZ bytes). > Currently this leads to BUG(). Other insane inputs (bad txqs, rxqs) and > even OOM don't lead to BUG(). Made alloc_netdev() return NULL, like on > other errors. The only way alloc_netdev could be called with a name too long was if some driver was incorrectly written. It is not something that can be exercised by user space. Please leave the BUG() so the driver will show up in kernel oops logs etc. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/core/dev.c b/net/core/dev.c index 6392ea0..12ef4b0 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5761,7 +5761,10 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, size_t alloc_size; struct net_device *p; - BUG_ON(strlen(name) >= sizeof(dev->name)); + if (strnlen(name, sizeof(dev->name)) >= sizeof(dev->name)) { + pr_err("alloc_netdev: Too long device name \n"); + return NULL; + } if (txqs < 1) { pr_err("alloc_netdev: Unable to allocate device "
alloc_netdev() may be called with too long name (more that IFNAMSIZ bytes). Currently this leads to BUG(). Other insane inputs (bad txqs, rxqs) and even OOM don't lead to BUG(). Made alloc_netdev() return NULL, like on other errors. Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> --- Compile tested. net/core/dev.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-)