Messages in this thread Patch in this message |  | | | Date | Wed, 18 Jul 2012 16:00:49 -0400 | | From | Jim Rees <> | | Subject | Re: [PATCH] SUNRPC: Prevent kernel stack corruption on long values of flush |
| |
J. Bruce Fields wrote:
On Tue, Jul 17, 2012 at 12:01:26AM +0200, Sasha Levin wrote: > The buffer size in read_flush() is too small for the longest possible values > for it. This can lead to a kernel stack corruption: Thanks!
> > diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c > index 2afd2a8..f86d95e 100644 > --- a/net/sunrpc/cache.c > +++ b/net/sunrpc/cache.c > @@ -1409,11 +1409,11 @@ static ssize_t read_flush(struct file *file, char __user *buf, > size_t count, loff_t *ppos, > struct cache_detail *cd) > { > - char tbuf[20]; > + char tbuf[22]; I wonder how common this sort of calculation is in the kernel? It might provide some peace of mind to be able to write this something like char tbuf[MAXLEN_BASE10_UL + 2] /* + 2 for final "\n\0" */ You could use something like:
char tbuf[sizeof (unsigned long) * 24 / 10 + 1 + 2]; /* + 2 for final "\n\0" */ since there are roughly 10 bits for every 3 decimal digits.
But I'm obviously confused, because I don't understand why tbuf needs to be any more than 10 + 2.
|  |