netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] fib_trie: potential out of bounds access in trie_show_stats()
@ 2013-07-22 19:01 Jerry Snitselaar
  2013-07-24 15:00 ` Hannes Frederic Sowa
  0 siblings, 1 reply; 3+ messages in thread
From: Jerry Snitselaar @ 2013-07-22 19:01 UTC (permalink / raw)
  To: netdev, linux-kernel

With the <= max condition in the for loop, it will be always go 1
element further than needed. If the condition for the while loop is
never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
end of nodesizes[].

Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>
---
 net/ipv4/fib_trie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 49616fe..108a1e9c 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -2133,7 +2133,7 @@ static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
 		max--;
 
 	pointers = 0;
-	for (i = 1; i <= max; i++)
+	for (i = 1; i < max; i++)
 		if (stat->nodesizes[i] != 0) {
 			seq_printf(seq, "  %u: %u",  i, stat->nodesizes[i]);
 			pointers += (1<<i) * stat->nodesizes[i];
-- 
1.8.3.2.701.g8c4e4ec

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] fib_trie: potential out of bounds access in trie_show_stats()
  2013-07-22 19:01 [PATCH] fib_trie: potential out of bounds access in trie_show_stats() Jerry Snitselaar
@ 2013-07-24 15:00 ` Hannes Frederic Sowa
  2013-07-24 23:05   ` David Miller
  0 siblings, 1 reply; 3+ messages in thread
From: Hannes Frederic Sowa @ 2013-07-24 15:00 UTC (permalink / raw)
  To: Jerry Snitselaar; +Cc: netdev, linux-kernel

On Mon, Jul 22, 2013 at 12:01:58PM -0700, Jerry Snitselaar wrote:
> With the <= max condition in the for loop, it will be always go 1
> element further than needed. If the condition for the while loop is
> never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
> end of nodesizes[].
> 
> Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>

Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

Thanks,

  Hannes

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH] fib_trie: potential out of bounds access in trie_show_stats()
  2013-07-24 15:00 ` Hannes Frederic Sowa
@ 2013-07-24 23:05   ` David Miller
  0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2013-07-24 23:05 UTC (permalink / raw)
  To: hannes; +Cc: jerry.snitselaar, netdev, linux-kernel

From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Wed, 24 Jul 2013 17:00:00 +0200

> On Mon, Jul 22, 2013 at 12:01:58PM -0700, Jerry Snitselaar wrote:
>> With the <= max condition in the for loop, it will be always go 1
>> element further than needed. If the condition for the while loop is
>> never met, then max is MAX_STAT_DEPTH, and for loop will walk off the
>> end of nodesizes[].
>> 
>> Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>
> 
> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>

Applied, thanks.

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2013-07-24 23:05 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-07-22 19:01 [PATCH] fib_trie: potential out of bounds access in trie_show_stats() Jerry Snitselaar
2013-07-24 15:00 ` Hannes Frederic Sowa
2013-07-24 23:05   ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).