| Message ID | 1279146277-9381-1-git-send-email-nicolas.2p.debian@free.fr |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Nicolas de Pesloüan <nicolas.2p.debian@free.fr> Date: Thu, 15 Jul 2010 00:24:37 +0200 > The test for buffer overflow ensures we have room for 6 more bytes. > sprintf, called with %s:%d, slave->dev->name, slave->queue_id may yield > far more than 6 bytes. > > The correct test is res > (PAGE_SIZE - IFNAMSIZ - 6) . > > Signed-off-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr> Applied to net-next-2.6, thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index f9a0343..1a99764 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ b/drivers/net/bonding/bond_sysfs.c @@ -1427,8 +1427,8 @@ static ssize_t bonding_show_queue_id(struct device *d, read_lock(&bond->lock); bond_for_each_slave(bond, slave, i) { - if (res > (PAGE_SIZE - 6)) { - /* not enough space for another interface name */ + if (res > (PAGE_SIZE - IFNAMSIZ - 6)) { + /* not enough space for another interface_name:queue_id pair */ if ((PAGE_SIZE - res) > 10) res = PAGE_SIZE - 10; res += sprintf(buf + res, "++more++ ");
The test for buffer overflow ensures we have room for 6 more bytes. sprintf, called with %s:%d, slave->dev->name, slave->queue_id may yield far more than 6 bytes. The correct test is res > (PAGE_SIZE - IFNAMSIZ - 6) . Signed-off-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr> --- drivers/net/bonding/bond_sysfs.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)