From: Robin Holt <holt@sgi•com>
To: Eric Dumazet <eric.dumazet@gmail•com>
Cc: Andrew Morton <akpm@linux-foundation•org>,
linux-kernel <linux-kernel@vger•kernel.org>,
Robin Holt <holt@sgi•com>, Willy Tarreau <w@1wt•eu>,
"David S. Miller" <davem@davemloft•net>,
netdev@vger•kernel.org, James Morris <jmorris@namei•org>,
Hideaki YOSHIFUJI <yoshfuji@linux-ipv6•org>,
"Pekka Savola (ipv6)" <pekkas@netcore•fi>,
Patrick McHardy <kaber@trash•net>,
Alexey Kuznetsov <kuznet@ms2•inr.ac.ru>
Subject: Re: [PATCH] sysctl: fix min/max handling in __do_proc_doulongvec_minmax()
Date: Mon, 4 Oct 2010 03:59:13 -0500 [thread overview]
Message-ID: <20101004085913.GR14068@sgi.com> (raw)
In-Reply-To: <1286025469.2582.1806.camel@edumazet-laptop>
On Sat, Oct 02, 2010 at 03:17:49PM +0200, Eric Dumazet wrote:
> When proc_doulongvec_minmax() is used with an array of longs,
> and no min/max check requested (.extra1 or .extra2 being NULL), we
> dereference a NULL pointer for the second element of the array.
>
> Noticed while doing some changes in network stack for the "16TB problem"
>
> Signed-off-by: Eric Dumazet <eric.dumazet@gmail•com>
> ---
> kernel/sysctl.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/sysctl.c b/kernel/sysctl.c
> index f88552c..4fba86d 100644
> --- a/kernel/sysctl.c
> +++ b/kernel/sysctl.c
> @@ -2500,7 +2500,8 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
> break;
> if (neg)
> continue;
> - if ((min && val < *min) || (max && val > *max))
> + if ((table->extra1 && val < *min) ||
> + (table->extra2 && val > *max))
How about changing:
for (; left && vleft--; i++, min++, max++, first=0) {
into:
for (; left && vleft--; i++, min = min ? min + 1 : NULL, max = max ? max + 1: NULL, first=0) {
That would make min and max correct and reduce the chances somebody in
the future overlooks the fact they are currently filled with garbage.
Robin
next prev parent reply other threads:[~2010-10-04 8:59 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-02 13:17 [PATCH] sysctl: fix min/max handling in __do_proc_doulongvec_minmax() Eric Dumazet
2010-10-04 3:09 ` Américo Wang
2010-10-04 8:59 ` Robin Holt [this message]
2010-10-04 9:04 ` Eric Dumazet
2010-10-04 9:34 ` Américo Wang
2010-10-04 10:10 ` Eric Dumazet
2010-10-04 10:35 ` Américo Wang
2010-10-04 10:38 ` Eric Dumazet
2010-10-05 13:01 ` Américo Wang
2010-10-07 7:18 ` Américo Wang
2010-10-07 9:25 ` Américo Wang
2010-10-07 9:51 ` Eric Dumazet
2010-10-07 16:37 ` Eric W. Biederman
2010-10-07 16:59 ` Eric Dumazet
2010-10-07 19:18 ` Andrew Morton
2010-10-07 19:38 ` Eric W. Biederman
2010-10-08 16:22 ` Américo Wang
2010-10-08 16:13 ` Américo Wang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20101004085913.GR14068@sgi.com \
--to=holt@sgi$(echo .)com \
--cc=akpm@linux-foundation$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=jmorris@namei$(echo .)org \
--cc=kaber@trash$(echo .)net \
--cc=kuznet@ms2$(echo .)inr.ac.ru \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pekkas@netcore$(echo .)fi \
--cc=w@1wt$(echo .)eu \
--cc=yoshfuji@linux-ipv6$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox