From patchwork Thu Aug 18 17:32:10 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarod Wilson X-Patchwork-Id: 9288791 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 06166607FF for ; Fri, 19 Aug 2016 01:02:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EBF112926D for ; Fri, 19 Aug 2016 01:02:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E107B2929C; Fri, 19 Aug 2016 01:02:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7923B2926D for ; Fri, 19 Aug 2016 01:02:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754539AbcHSBCJ (ORCPT ); Thu, 18 Aug 2016 21:02:09 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37274 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754638AbcHSBCH (ORCPT ); Thu, 18 Aug 2016 21:02:07 -0400 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id C56EC80F75; Thu, 18 Aug 2016 17:32:38 +0000 (UTC) Received: from hp-dl360pgen8-07.khw.lab.eng.bos.redhat.com (hp-dl360pgen8-07.khw.lab.eng.bos.redhat.com [10.16.184.47]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u7IHWUAH018884; Thu, 18 Aug 2016 13:32:38 -0400 From: Jarod Wilson To: linux-rdma@vger.kernel.org Cc: Jarod Wilson , Gil Rockah Subject: [PATCH perftest 15/23] perftest_communication: fix overflow w/size_of_cur=4 Date: Thu, 18 Aug 2016 13:32:10 -0400 Message-Id: <1471541538-20270-16-git-send-email-jarod@redhat.com> In-Reply-To: <1471541538-20270-1-git-send-email-jarod@redhat.com> References: <1471541538-20270-1-git-send-email-jarod@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Thu, 18 Aug 2016 17:32:38 +0000 (UTC) Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP First up, we have rem[2] and cur[2], and then we figure out what to set size_of_cur to -- either 2 or 4. If it's 4 though... we then try to do a ctx_xchg_data() on rem and cur with a size of 4, which results in buffer overflows and memory corruption. Just make cur and rem size 4 instead. CC: Gil Rockah Signed-off-by: Jarod Wilson --- src/perftest_communication.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/perftest_communication.c b/src/perftest_communication.c index d938e41..b66801c 100755 --- a/src/perftest_communication.c +++ b/src/perftest_communication.c @@ -1706,8 +1706,8 @@ void check_sys_data(struct perftest_comm *user_comm, struct perftest_parameters ******************************************************************************/ int check_mtu(struct ibv_context *context,struct perftest_parameters *user_param, struct perftest_comm *user_comm) { int curr_mtu=0, rem_mtu=0; - char cur[2]; - char rem[2]; + char cur[4]; + char rem[4]; int size_of_cur; if (user_param->connection_type == RawEth) {