From 20b0c718c3bb122107bebadbb8ecf4bab76fb392 Mon Sep 17 00:00:00 2001 From: Mathias Krause Date: Fri, 21 Feb 2014 21:38:34 +0100 Subject: [PATCH] pktgen: fix out-of-bounds access in pgctrl_write() If a privileged user writes an empty string to /proc/net/pktgen/pgctrl the code for stripping the (then non-existent) '\n' actually writes the zero byte at index -1 of data[]. The then still uninitialized array will very likely fail the command matching tests and the pr_warning() at the end will therefore leak stack bytes to the kernel log. Fix those issues by simply ensuring we're passed a non-empty string as the user API apparently expects a trailing '\n' for all commands. Cc: "David S. Miller" Signed-off-by: Mathias Krause Signed-off-by: David S. Miller --- net/core/pktgen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/pktgen.c b/net/core/pktgen.c index fdac61cac1bd..cc07c434948a 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -485,6 +485,9 @@ static ssize_t pgctrl_write(struct file *file, const char __user *buf, goto out; } + if (count == 0) + return -EINVAL; + if (count > sizeof(data)) count = sizeof(data); @@ -492,7 +495,7 @@ static ssize_t pgctrl_write(struct file *file, const char __user *buf, err = -EFAULT; goto out; } - data[count - 1] = 0; /* Make string */ + data[count - 1] = 0; /* Strip trailing '\n' and terminate string */ if (!strcmp(data, "stop")) pktgen_stop_all_threads_ifs(pn); -- 2.25.1