* [PATCH] fib_trie: potential out of bounds access in trie_show_stats()
@ 2013-07-22 19:01 Jerry Snitselaar
2013-07-24 15:00 ` Hannes Frederic Sowa
0 siblings, 1 reply; 3+ messages in thread
From: Jerry Snitselaar @ 2013-07-22 19:01 UTC (permalink / raw)
To: netdev, linux-kernel
With the <= max condition in the for loop, it will be always go 1
element further than needed. If the condition for the while loop is
never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
end of nodesizes[].
Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>
---
net/ipv4/fib_trie.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fe..108a1e9c 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
max--;
pointers = 0;
- for (i = 1; i <= max; i++)
+ for (i = 1; i < max; i++)
if (stat->nodesizes[i] != 0) {
seq_printf(seq, " %u: %u", i, stat->nodesizes[i]);
pointers += (1<<i) * stat->nodesizes[i];
--
1.8.3.2.701.g8c4e4ec
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] fib_trie: potential out of bounds access in trie_show_stats()
2013-07-22 19:01 [PATCH] fib_trie: potential out of bounds access in trie_show_stats() Jerry Snitselaar
@ 2013-07-24 15:00 ` Hannes Frederic Sowa
2013-07-24 23:05 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Hannes Frederic Sowa @ 2013-07-24 15:00 UTC (permalink / raw)
To: Jerry Snitselaar; +Cc: netdev, linux-kernel
On Mon, Jul 22, 2013 at 12:01:58PM -0700, Jerry Snitselaar wrote:
> With the <= max condition in the for loop, it will be always go 1
> element further than needed. If the condition for the while loop is
> never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
> end of nodesizes[].
>
> Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Thanks,
Hannes
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] fib_trie: potential out of bounds access in trie_show_stats()
2013-07-24 15:00 ` Hannes Frederic Sowa
@ 2013-07-24 23:05 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2013-07-24 23:05 UTC (permalink / raw)
To: hannes; +Cc: jerry.snitselaar, netdev, linux-kernel
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Wed, 24 Jul 2013 17:00:00 +0200
> On Mon, Jul 22, 2013 at 12:01:58PM -0700, Jerry Snitselaar wrote:
>> With the <= max condition in the for loop, it will be always go 1
>> element further than needed. If the condition for the while loop is
>> never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
>> end of nodesizes[].
>>
>> Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>
>
> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-07-24 23:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-07-22 19:01 [PATCH] fib_trie: potential out of bounds access in trie_show_stats() Jerry Snitselaar
2013-07-24 15:00 ` Hannes Frederic Sowa
2013-07-24 23:05 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).