lkml.org 
[lkml]   [2010]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] pktgen: Remove a dangerous debug print.
Date
We were allocating an arbitrarily-large buffer on the stack, which would allow a
buggy or malicious userspace program to overflow the kernel stack.

Since the debug printk() was just printing exactly the text passed from
userspace, it's probably just as easy for anyone who might use it to augment (or
just strace(1)) the program writing to the pktgen file, so let's just not bother
trying to print the whole buffer.

Signed-off-by: Nelson Elhage <nelhage@ksplice.com>
---
net/core/pktgen.c | 11 +++--------
1 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 10a1ea7..de8e0da 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -888,14 +888,9 @@ static ssize_t pktgen_if_write(struct file *file,

i += len;

- if (debug) {
- char tb[count + 1];
- if (copy_from_user(tb, user_buffer, count))
- return -EFAULT;
- tb[count] = 0;
- printk(KERN_DEBUG "pktgen: %s,%lu buffer -:%s:-\n", name,
- (unsigned long)count, tb);
- }
+ if (debug)
+ printk(KERN_DEBUG "pktgen: %s,%lu\n", name,
+ (unsigned long)count);

if (!strcmp(name, "min_pkt_size")) {
len = num_arg(&user_buffer[i], 10, &value);
--
1.7.1.31.g6297e


\
 
 \ /
  Last update: 2010-10-27 21:57    [W:0.053 / U:0.228 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site