Re: buffer overflow in /proc/sys/sunrpc/transports

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
To: Vegard Nossum <vegard.nossum@...>
Cc: Tom Tucker <tom@...>, Neil Brown <neilb@...>, Chuck Lever <chuck.lever@...>, Greg Banks <gnb@...>, J. Bruce Fields <bfields@...>, <linux-kernel@...>
Date: Saturday, August 30, 2008 - 3:06 pm

[Vegard Nossum - Sat, Aug 30, 2008 at 08:44:22PM +0200]
| Hi,
| 
| I noticed that something weird is going on with /proc/sys/sunrpc/transports.
| This file is generated in net/sunrpc/sysctl.c, function proc_do_xprt(). When
| I "cat" this file, I get the expected output:
| 
|     $ cat /proc/sys/sunrpc/transports 
|     tcp 1048576
|     udp 32768
| 
| But I think that it does not check the length of the buffer supplied by
| userspace to read(). With my original program, I found that the stack was
| being overwritten by the characters above, even when the length given to
| read() was just 1. So I have created a test program, see it at the bottom of
| this e-mail. Here is its output:
| 
...

Indeed, maybe just add checking for user buffer length?
As proc_dodebug() in this file are doing. I don't think
the user would be happy with his stack burned :)

Something like:
---

Index: linux-2.6.git/net/sunrpc/sysctl.c
===================================================================
--- linux-2.6.git.orig/net/sunrpc/sysctl.c	2008-07-20 11:40:14.000000000 +0400
+++ linux-2.6.git/net/sunrpc/sysctl.c	2008-08-30 23:05:30.000000000 +0400
@@ -69,6 +69,8 @@ static int proc_do_xprt(ctl_table *table
 		return -EINVAL;
 	else {
 		len = svc_print_xprts(tmpbuf, sizeof(tmpbuf));
+		if (*lenp < len)
+			return -EFAULT;
 		if (!access_ok(VERIFY_WRITE, buffer, len))
 			return -EFAULT;
 
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]

Messages in current thread:
buffer overflow in /proc/sys/sunrpc/transports, Vegard Nossum, (Sat Aug 30, 2:44 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 3:06 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Vegard Nossum, (Sat Aug 30, 3:42 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 3:56 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Vegard Nossum, (Sat Aug 30, 3:59 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 4:04 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Vegard Nossum, (Sat Aug 30, 4:13 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 4:29 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 4:15 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 3:45 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Vegard Nossum, (Sat Aug 30, 3:15 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 3:21 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Vegard Nossum, (Sat Aug 30, 3:34 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 3:44 pm)
Re: buffer overflow in /proc/sys/sunrpc/transports, Cyrill Gorcunov, (Sat Aug 30, 3:23 pm)