From patchwork Sat Mar 5 12:28:33 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Sven Eckelmann X-Patchwork-Id: 826 Return-Path: Received: from v3-1039.vlinux.de (narfation.org [79.140.41.39]) by open-mesh.org (Postfix) with ESMTPS id 0A6CB154214 for ; Sat, 5 Mar 2011 13:30:07 +0100 (CET) Authentication-Results: open-mesh.org; dkim=pass (1024-bit key) header.i=@narfation.org; dkim-adsp=pass Received: from sven-desktop.home.narfation.org (i59F6B254.versanet.de [89.246.178.84]) by v3-1039.vlinux.de (Postfix) with ESMTPSA id D7A2D940C7; Sat, 5 Mar 2011 13:30:03 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=narfation.org; s=mail; t=1299328204; bh=H7uuaUdwyIWXitt7VzV6BSFQEYbfS3O6tnihF5GNCPQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type:Content-Transfer-Encoding; b=LUJ66frfPhct6g6vsr+cCtjTueA6Ai0GgRig9z1sfdxXwA43KQu2YTSpwmere0/9S h7YRRmfiIOXt04Da/vP1q5g559+D043+Lnda3bPm5+gZTFE9weBKEeV2Ay516FlCSa LyNKnz7zR+utlqRTn3hoki8naNxOZ4/Xd6ALDSqo= From: Sven Eckelmann To: davem@davemloft.net Date: Sat, 5 Mar 2011 13:28:33 +0100 Message-Id: <1299328122-21468-20-git-send-email-sven@narfation.org> X-Mailer: git-send-email 1.7.2.3 In-Reply-To: <1299328122-21468-1-git-send-email-sven@narfation.org> References: <1299328122-21468-1-git-send-email-sven@narfation.org> MIME-Version: 1.0 Cc: netdev@vger.kernel.org, b.a.t.m.a.n@lists.open-mesh.org, Marek Lindner , =?UTF-8?q?Linus=20L=C3=BCssing?= Subject: [B.A.T.M.A.N.] [PATCH 19/28] batman-adv: Fix possible buffer overflow in softif neigh list output X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.13 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 05 Mar 2011 12:30:07 -0000 From: Linus Lüssing When printing the soft interface table the number of entries in the softif neigh list are first being counted and a fitting buffer allocated. After that the softif neigh list gets locked again and the buffer printed - which has the following two issues: For one thing, the softif neigh list might have grown when reacquiring the rcu lock, which results in writing outside of the allocated buffer. Furthermore 31 Bytes are not enough for printing an entry with a vid of more than 2 digits. The manual buffering is unnecessary, we can safely print to the seq directly during the rcu_read_lock(). Signed-off-by: Linus Lüssing Signed-off-by: Marek Lindner --- net/batman-adv/soft-interface.c | 22 +--------------------- 1 files changed, 1 insertions(+), 21 deletions(-) diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c index 152beaa..c30ccd6 100644 --- a/net/batman-adv/soft-interface.c +++ b/net/batman-adv/soft-interface.c @@ -171,8 +171,6 @@ int softif_neigh_seq_print_text(struct seq_file *seq, void *offset) struct bat_priv *bat_priv = netdev_priv(net_dev); struct softif_neigh *softif_neigh; struct hlist_node *node; - size_t buf_size, pos; - char *buff; if (!bat_priv->primary_if) { return seq_printf(seq, "BATMAN mesh %s disabled - " @@ -182,33 +180,15 @@ int softif_neigh_seq_print_text(struct seq_file *seq, void *offset) seq_printf(seq, "Softif neighbor list (%s)\n", net_dev->name); - buf_size = 1; - /* Estimate length for: " xx:xx:xx:xx:xx:xx\n" */ rcu_read_lock(); hlist_for_each_entry_rcu(softif_neigh, node, &bat_priv->softif_neigh_list, list) - buf_size += 30; - rcu_read_unlock(); - - buff = kmalloc(buf_size, GFP_ATOMIC); - if (!buff) - return -ENOMEM; - - buff[0] = '\0'; - pos = 0; - - rcu_read_lock(); - hlist_for_each_entry_rcu(softif_neigh, node, - &bat_priv->softif_neigh_list, list) { - pos += snprintf(buff + pos, 31, "%s %pM (vid: %d)\n", + seq_printf(seq, "%s %pM (vid: %d)\n", bat_priv->softif_neigh == softif_neigh ? "=>" : " ", softif_neigh->addr, softif_neigh->vid); - } rcu_read_unlock(); - seq_printf(seq, "%s", buff); - kfree(buff); return 0; }