lkml.org 
[lkml]   [2009]   [Oct]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRE: [patch 37/37] sit: fix off-by-one in ipip6_tunnel_get_prl
    Wait a moment - I remember now that this code came
    from Yoshifuji, and I believe there was a reason for
    the cmax+1. The application is expected to know this
    and to post a large enough buffer.

    Can we put this on hold until I have had a chance to
    check my e-mail archives and my local iproute changes
    (will respond on monday)?

    Thanks - Fred
    fred.l.templin@boeing.com

    > -----Original Message-----
    > From: Greg KH [mailto:gregkh@suse.de]
    > Sent: Friday, October 09, 2009 4:35 PM
    > To: linux-kernel@vger.kernel.org; stable@kernel.org
    > Cc: stable-review@kernel.org; torvalds@linux-foundation.org; akpm@linux-foundation.org;
    > alan@lxorguk.ukuu.org.uk; Sascha Hlusiak; Templin, Fred L; David S. Miller
    > Subject: [patch 37/37] sit: fix off-by-one in ipip6_tunnel_get_prl
    >
    > 2.6.31-stable review patch. If anyone has any objections, please let us know.
    >
    > ------------------
    > From: Sascha Hlusiak <contact@saschahlusiak.de>
    >
    > [ Upstream commit 298bf12ddb25841804f26234a43b89da1b1c0e21 ]
    >
    > When requesting all prl entries (kprl.addr == INADDR_ANY) and there are
    > more prl entries than there is space passed from userspace, the existing
    > code would always copy cmax+1 entries, which is more than can be handled.
    >
    > This patch makes the kernel copy only exactly cmax entries.
    >
    > Signed-off-by: Sascha Hlusiak <contact@saschahlusiak.de>
    > Acked-By: Fred L. Templin <Fred.L.Templin@boeing.com>
    > Signed-off-by: David S. Miller <davem@davemloft.net>
    > Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    > ---
    > net/ipv6/sit.c | 2 +-
    > 1 file changed, 1 insertion(+), 1 deletion(-)
    >
    > --- a/net/ipv6/sit.c
    > +++ b/net/ipv6/sit.c
    > @@ -313,7 +313,7 @@ static int ipip6_tunnel_get_prl(struct i
    >
    > c = 0;
    > for (prl = t->prl; prl; prl = prl->next) {
    > - if (c > cmax)
    > + if (c >= cmax)
    > break;
    > if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
    > continue;
    >



    \
     
     \ /
      Last update: 2009-10-10 03:19    [W:2.923 / U:0.348 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site