From: Daniel Borkmann <daniel@iogearbox•net>
To: Stephen Hemminger <stephen@networkplumber•org>
Cc: "Guzman Mosqueda, Jose R" <jose.r.guzman.mosqueda@intel•com>,
Vadim Kochan <vadim4j@gmail•com>,
"netdev@vger•kernel.org" <netdev@vger•kernel.org>,
eric.dumazet@gmail•com
Subject: Re: [PATCH iproute2] ss: Fix allocation of cong control alg name
Date: Thu, 25 Jun 2015 09:12:41 +0200 [thread overview]
Message-ID: <558BA9E9.1020200@iogearbox.net> (raw)
In-Reply-To: <20150624233119.4f6e3a72@uryu.home.lan>
On 06/25/2015 05:31 AM, Stephen Hemminger wrote:
> On Fri, 29 May 2015 18:48:42 +0200
> Daniel Borkmann <daniel@iogearbox•net> wrote:
>
>> On 05/29/2015 06:17 PM, Guzman Mosqueda, Jose R wrote:
>>> Hi Daniel and Vadim
>>>
>>> Thanks for your prompt response and for the patch.
>>>
>>> Also, what about the other one? Do you think it is an issue or not?
>>>
>>> " File: tc/tc_util.c
>>> Function: void print_rate(char *buf, int len, __u64 rate)
>>> Line: ~264
>>>
>>> In the case that user inputs a high value for rate, the "for" loop will exit in the condition meaning that variable "i" get the value of 5 which will be an invalid index for the "units" array due to that array has only 5 elements."
>>>
>>> I know a very high value is invalid but in the case that it comes directly from user, it could cause and issue, what do you think?
>>
>> Hm, this prints just the netlink dump from kernel side, but perhaps
>> we should just change it ...
>>
>> diff --git a/tc/tc_util.c b/tc/tc_util.c
>> index dc2b70f..aa6de24 100644
>> --- a/tc/tc_util.c
>> +++ b/tc/tc_util.c
>> @@ -250,18 +250,19 @@ void print_rate(char *buf, int len, __u64 rate)
>> extern int use_iec;
>> unsigned long kilo = use_iec ? 1024 : 1000;
>> const char *str = use_iec ? "i" : "";
>> - int i = 0;
>> static char *units[5] = {"", "K", "M", "G", "T"};
>> + int i;
>>
>> rate <<= 3; /* bytes/sec -> bits/sec */
>>
>> - for (i = 0; i < ARRAY_SIZE(units); i++) {
>> + for (i = 0; i < ARRAY_SIZE(units) - 1; i++) {
>> if (rate < kilo)
>> break;
>> if (((rate % kilo) != 0) && rate < 1000*kilo)
>> break;
>> rate /= kilo;
>> }
>> +
>> snprintf(buf, len, "%.0f%s%sbit", (double)rate, units[i], str);
>> }
>
> I don't know what thread you meant to hijack for this, but it wasn't the
> one about ss: cong name.
Jose did top-post on the first reported issue asking about the 2nd one, I
think that's how we ended up here. ;)
prev parent reply other threads:[~2015-06-25 7:12 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-05-29 10:30 [PATCH iproute2] ss: Fix allocation of cong control alg name Vadim Kochan
2015-05-29 11:04 ` Eric Dumazet
2015-05-29 11:11 ` Daniel Borkmann
2015-05-29 12:53 ` Vadim Kochan
2015-05-29 15:15 ` Eric Dumazet
2015-05-29 11:09 ` Daniel Borkmann
2015-05-29 16:17 ` Guzman Mosqueda, Jose R
2015-05-29 16:48 ` Daniel Borkmann
2015-06-25 3:31 ` Stephen Hemminger
2015-06-25 7:12 ` Daniel Borkmann [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=558BA9E9.1020200@iogearbox.net \
--to=daniel@iogearbox$(echo .)net \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=jose.r.guzman.mosqueda@intel$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=stephen@networkplumber$(echo .)org \
--cc=vadim4j@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox