lkml.org 
[lkml]   [2018]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 11/80] KEYS: DNS: limit the length of option strings
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Biggers <ebiggers@google.com>


    [ Upstream commit 9c438d7a3a52dcc2b9ed095cb87d3a5e83cf7e60 ]

    Adding a dns_resolver key whose payload contains a very long option name
    resulted in that string being printed in full. This hit the WARN_ONCE()
    in set_precision() during the printk(), because printk() only supports a
    precision of up to 32767 bytes:

    precision 1000000 too large
    WARNING: CPU: 0 PID: 752 at lib/vsprintf.c:2189 vsnprintf+0x4bc/0x5b0

    Fix it by limiting option strings (combined name + value) to a much more
    reasonable 128 bytes. The exact limit is arbitrary, but currently the
    only recognized option is formatted as "dnserror=%lu" which fits well
    within this limit.

    Also ratelimit the printks.

    Reproducer:

    perl -e 'print "#", "A" x 1000000, "\x00"' | keyctl padd dns_resolver desc @s

    This bug was found using syzkaller.

    Reported-by: Mark Rutland <mark.rutland@arm.com>
    Fixes: 4a2d789267e0 ("DNS: If the DNS server returns an error, allow that to be cached [ver #2]")
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/dns_resolver/dns_key.c | 13 ++++++-------
    1 file changed, 6 insertions(+), 7 deletions(-)

    --- a/net/dns_resolver/dns_key.c
    +++ b/net/dns_resolver/dns_key.c
    @@ -25,6 +25,7 @@
    #include <linux/moduleparam.h>
    #include <linux/slab.h>
    #include <linux/string.h>
    +#include <linux/ratelimit.h>
    #include <linux/kernel.h>
    #include <linux/keyctl.h>
    #include <linux/err.h>
    @@ -91,9 +92,9 @@ dns_resolver_preparse(struct key_prepars

    next_opt = memchr(opt, '#', end - opt) ?: end;
    opt_len = next_opt - opt;
    - if (!opt_len) {
    - printk(KERN_WARNING
    - "Empty option to dns_resolver key\n");
    + if (opt_len <= 0 || opt_len > 128) {
    + pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n",
    + opt_len);
    return -EINVAL;
    }

    @@ -127,10 +128,8 @@ dns_resolver_preparse(struct key_prepars
    }

    bad_option_value:
    - printk(KERN_WARNING
    - "Option '%*.*s' to dns_resolver key:"
    - " bad/missing value\n",
    - opt_nlen, opt_nlen, opt);
    + pr_warn_ratelimited("Option '%*.*s' to dns_resolver key: bad/missing value\n",
    + opt_nlen, opt_nlen, opt);
    return -EINVAL;
    } while (opt = next_opt + 1, opt < end);
    }

    \
     
     \ /
      Last update: 2018-04-27 16:58    [W:5.103 / U:0.672 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site