Messages in this thread Patch in this message | | | Date | Sat, 30 Aug 2008 23:06:42 +0400 | From | Cyrill Gorcunov <> | Subject | Re: buffer overflow in /proc/sys/sunrpc/transports |
| |
[Vegard Nossum - Sat, Aug 30, 2008 at 08:44:22PM +0200] | Hi, | | I noticed that something weird is going on with /proc/sys/sunrpc/transports. | This file is generated in net/sunrpc/sysctl.c, function proc_do_xprt(). When | I "cat" this file, I get the expected output: | | $ cat /proc/sys/sunrpc/transports | tcp 1048576 | udp 32768 | | But I think that it does not check the length of the buffer supplied by | userspace to read(). With my original program, I found that the stack was | being overwritten by the characters above, even when the length given to | read() was just 1. So I have created a test program, see it at the bottom of | this e-mail. Here is its output: | ...
Indeed, maybe just add checking for user buffer length? As proc_dodebug() in this file are doing. I don't think the user would be happy with his stack burned :)
Something like: ---
Index: linux-2.6.git/net/sunrpc/sysctl.c =================================================================== --- linux-2.6.git.orig/net/sunrpc/sysctl.c 2008-07-20 11:40:14.000000000 +0400 +++ linux-2.6.git/net/sunrpc/sysctl.c 2008-08-30 23:05:30.000000000 +0400 @@ -69,6 +69,8 @@ static int proc_do_xprt(ctl_table *table return -EINVAL; else { len = svc_print_xprts(tmpbuf, sizeof(tmpbuf)); + if (*lenp < len) + return -EFAULT; if (!access_ok(VERIFY_WRITE, buffer, len)) return -EFAULT;
| |