diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-07-14 17:56:37 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-07-14 17:56:37 -0700 |
| commit | 0eff683f737bf684dc9299e2eaca79cceb80a8c1 (patch) | |
| tree | ab92685be15606c06dbab82c581a3b1c0da72986 | |
| parent | f8320f059296eb8cab6e2429c7ec79b43d42cf42 (diff) | |
| download | linux-0eff683f737bf684dc9299e2eaca79cceb80a8c1.tar.gz linux-0eff683f737bf684dc9299e2eaca79cceb80a8c1.tar.bz2 linux-0eff683f737bf684dc9299e2eaca79cceb80a8c1.zip | |
net/sched: potential data corruption
The reset_policy() does:
memset(d->tcfd_defdata, 0, SIMP_MAX_DATA);
strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA);
In the original code, the size of d->tcfd_defdata wasn't fixed and if
strlen(defdata) was less than 31, reset_policy() would cause memory
corruption.
Please Note: The original alloc_defdata() assumes defdata is 32
characters and a NUL terminator while reset_policy() assumes defdata is
31 characters and a NUL. This patch updates alloc_defdata() to match
reset_policy() (ie a shorter string). I'm not very familiar with this
code so please review carefully.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/sched/act_simple.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c index 1b4bc691d7d1..4a1d640b0cf1 100644 --- a/net/sched/act_simple.c +++ b/net/sched/act_simple.c @@ -73,10 +73,10 @@ static int tcf_simp_release(struct tcf_defact *d, int bind) static int alloc_defdata(struct tcf_defact *d, char *defdata) { - d->tcfd_defdata = kstrndup(defdata, SIMP_MAX_DATA, GFP_KERNEL); + d->tcfd_defdata = kzalloc(SIMP_MAX_DATA, GFP_KERNEL); if (unlikely(!d->tcfd_defdata)) return -ENOMEM; - + strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA); return 0; } |