Subject: Re: [patch v3] fix stack overflow in pktgen_if_write()

From: Andi Kleen <[email-masked]>
Date: Fri, 29 Oct 2010 01:11:57 +0200

Dan Carpenter <[email-masked]> writes:

> Reported-by: Nelson Elhage <[email-masked]>
> Signed-off-by: Dan Carpenter <[email-masked]>
> ---
> v3:  just use kmalloc()
>
> diff --git a/net/core/pktgen.c b/net/core/pktgen.c
> index 2c0df0f..c8d3620 100644
> --- a/net/core/pktgen.c
> +++ b/net/core/pktgen.c
> @@ -887,12 +887,17 @@ static ssize_t pktgen_if_write(struct file *file,
>  	i += len;
>  
>  	if (debug) {
> -		char tb[count + 1];
> +		char *tb;
> +
> +		tb = kmalloc(count + 1, GFP_KERNEL);

This is still trivially exploitable (for root) -- think what happens
when count is near ULONG_MAX

-Andi

-- 
[email-masked] -- Speaking for myself only.