diff options
| author |   Nicolas de Pesloüan <nicolas.2p.debian@free.fr> | 2010-07-14 18:24:54 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2010-07-14 18:24:54 -0700 |
| commit | 79236680bde29913dc6bfaf9165973b74223d5f7 (patch) | |
| tree | a34d509c3afa9596e02af63c54d407b4fd8266b1 /drivers/net | |
| parent | eth16i: fix memory leak (diff) | |
| download | linux-dev-79236680bde29913dc6bfaf9165973b74223d5f7.tar.xz linux-dev-79236680bde29913dc6bfaf9165973b74223d5f7.zip | |
bonding: fix a buffer overflow in bonding_show_queue_id.
The test for buffer overflow ensures we have room for 6 more bytes.
sprintf, called with %s:%d, slave->dev->name, slave->queue_id may yield
far more than 6 bytes.
The correct test is res > (PAGE_SIZE - IFNAMSIZ - 6) .
Signed-off-by: Nicolas de Pesloüan <nicolas.2p.debian@free.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/bonding/bond_sysfs.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c index f9a034361a8e..1a9976487099 100644 --- a/drivers/net/bonding/bond_sysfs.c +++ b/drivers/net/bonding/bond_sysfs.c @@ -1427,8 +1427,8 @@ static ssize_t bonding_show_queue_id(struct device *d, read_lock(&bond->lock); bond_for_each_slave(bond, slave, i) { - if (res > (PAGE_SIZE - 6)) { - /* not enough space for another interface name */ + if (res > (PAGE_SIZE - IFNAMSIZ - 6)) { + /* not enough space for another interface_name:queue_id pair */ if ((PAGE_SIZE - res) > 10) res = PAGE_SIZE - 10; res += sprintf(buf + res, "++more++ "); |