From patchwork Mon Sep 18 18:46:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 13390251 X-Patchwork-Delegate: stephen@networkplumber.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BBE21F947 for ; Mon, 18 Sep 2023 18:46:43 +0000 (UTC) Received: from mail-pl1-x631.google.com (mail-pl1-x631.google.com [IPv6:2607:f8b0:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C9C3109 for ; Mon, 18 Sep 2023 11:46:42 -0700 (PDT) Received: by mail-pl1-x631.google.com with SMTP id d9443c01a7336-1c47309a8ccso11062495ad.1 for ; Mon, 18 Sep 2023 11:46:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20230601.gappssmtp.com; s=20230601; t=1695062801; x=1695667601; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=i/zqxewMwzXBN5mCCqc1z6PKAhih/Vj2GXJTmg+7m3c=; b=go7hBU9dzQRgVFQsIFkc30Jy3iYT7MMe+igDotRNeF1gCu4CR7thgpdeNipUEQYG0V zqrnJahsrFe9Mq4GI1tI1IsOoKH5Spa8hMI4ChED5+s/imNy67lAgcbop4To5VOIKZWY vI89bo5CCcOtPawEOr2Q8gFPW5fz1VhtaNf3a3KRzbd00Jt/D9FPNLfuH86u83OmnPo0 ul7rOVN8URGwiSytGYj3QeCRvpwSfBeBpyowEWvN8bhOanIhu5Y9C/b4pQd2Tv/8UrQS RsvPKcAac0olBR0lc69zJ6l6VAXrnRh89QRDAphzdPW1t6JUbYHOHNgWNXTJg6XUK1gr u6Pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695062801; x=1695667601; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=i/zqxewMwzXBN5mCCqc1z6PKAhih/Vj2GXJTmg+7m3c=; b=wKwVuEzZEAWW0jdSID7k11BLs6cwUTT9gp6TQHonXpg9Y0KM9rSOPy9morSYPuQcvP C9VBN1QNvvG25mkiQf9VPcGX+knsQkzfcSQNQ949m870O6cnYP2lnAW8fmUYniCiJEBm 7C+B9aeLx8y/l/YR5zgs19qgao4YOCWti/19c3V8Us9m+5XxNqxLMW+pycLktXM/SbKv wRFGoNJGkxA8SM3asPKwyMyOhsm46AuH+OnuwaGcscM0JJQs4MmZy0a+tWEKDNi9a388 BtfCppCnBNKTxXv/CU1i6s73fQ4tNesKd+LbQ3YDsSFlKAyqsaK4gq2xo+pCZ4vtrA7i poNw== X-Gm-Message-State: AOJu0YxnmQPBmKV15j4qD7xUl7ygn2kfsWpg+AEB0K7+BoYF1WAjT0wR 1WyniyEFT14Rx/7PVwy1kh6oM9CRLJz2ZaxYmbuYaA== X-Google-Smtp-Source: AGHT+IHIHegstGuWy6JHK+cJgvwflewbqQEhGidnVx7m3JmwdP+QC8aYu/BfVzHAkpAygDaKyaH8kw== X-Received: by 2002:a17:902:d2ca:b0:1bb:d586:d29a with SMTP id n10-20020a170902d2ca00b001bbd586d29amr588649plc.34.1695062801365; Mon, 18 Sep 2023 11:46:41 -0700 (PDT) Received: from hermes.local (204-195-112-131.wavecable.com. [204.195.112.131]) by smtp.gmail.com with ESMTPSA id c12-20020a170903234c00b001bbfa86ca3bsm4488052plh.78.2023.09.18.11.46.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 Sep 2023 11:46:41 -0700 (PDT) From: Stephen Hemminger To: netdev@vger.kernel.org Cc: Stephen Hemminger Subject: [PATCH iproute2 1/2] bridge: fix potential snprintf overflow Date: Mon, 18 Sep 2023 11:46:30 -0700 Message-Id: <20230918184631.16228-1-stephen@networkplumber.org> X-Mailer: git-send-email 2.39.2 Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net X-Patchwork-Delegate: dsahern@gmail.com There is a theoretical snprintf overflow in bridge slave bitmask print code found by CodeQL scan. Signed-off-by: Stephen Hemminger --- ip/iplink_bridge_slave.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/ip/iplink_bridge_slave.c b/ip/iplink_bridge_slave.c index dc73c86574da..3821923b5da5 100644 --- a/ip/iplink_bridge_slave.c +++ b/ip/iplink_bridge_slave.c @@ -100,13 +100,20 @@ static void _bitmask2str(__u16 bitmask, char *dst, size_t dst_size, int len, i; for (i = 0, len = 0; bitmask; i++, bitmask >>= 1) { + int n; + if (bitmask & 0x1) { if (tbl[i]) - len += snprintf(dst + len, dst_size - len, "%s,", + n = snprintf(dst + len, dst_size - len, "%s,", tbl[i]); else - len += snprintf(dst + len, dst_size - len, "0x%x,", + n = snprintf(dst + len, dst_size - len, "0x%x,", (1 << i)); + + if (n < 0 || n >= dst_size - len) + break; + + len += n; } } From patchwork Mon Sep 18 18:46:31 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 13390252 X-Patchwork-Delegate: stephen@networkplumber.org Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D213520B02 for ; Mon, 18 Sep 2023 18:46:44 +0000 (UTC) Received: from mail-pl1-x632.google.com (mail-pl1-x632.google.com [IPv6:2607:f8b0:4864:20::632]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 66DA8FC for ; Mon, 18 Sep 2023 11:46:43 -0700 (PDT) Received: by mail-pl1-x632.google.com with SMTP id d9443c01a7336-1c4194f7635so30055515ad.0 for ; Mon, 18 Sep 2023 11:46:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20230601.gappssmtp.com; s=20230601; t=1695062802; x=1695667602; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=E89Q4xIcaPhNYK1IxEacI2MQhYUEya9nr7PdumjkbZo=; b=nCKuhl3K2wI1dluKfmxhloOlXfhbv2sx/naGW80RNapE+C1N0lpJR+b0aMBKwgVt4S JzYifkpnuVkyAhyFcf/aVscCSXJ+rxhdYFVykzAkYmE6qbIj2xVQaFp85g250g4+aSaY hveAqaCDw2vodrNlvOrtMuWA3HtGckhIY8N+U4y7pobsoFJHCeBnhmz1KP1wlNX+aOFb dbW1jyja3oaRIRbUfW9DesFQwgDv35GZK5dlsMqJM0Xl+4ZDGLpi0Achp/qHi0nF74yO BG4JWIfzXEg7HJJse6aFQpGwe6J13AasN5xGdHfeMPd3N8tWtUUa/qo5Lzm+x3h+OOUM V6Bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1695062802; x=1695667602; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=E89Q4xIcaPhNYK1IxEacI2MQhYUEya9nr7PdumjkbZo=; b=S8GKRCHdETjK63JxW/Piy+rcN4ZWQF35tRSOgU2mQHtsF2n0kRqDs6U1E1BR6me/Vq 94cC9cV7BztRjpv568FdC0RwTiTRrTSYFWQYcEYZLJv7pY2SMqNifjYBrGjCo4Orxmbe c7ErzUpG3v1JkYAH3XmdUaDbo1/oNjpd9Fiq/zCumdlvEpg21vNzcXvm7nnhQpVG1rDO AYXpSRAlMb8ty2IClHluTLHdV7haDjx3d3MdwW4HU/f25aPuOC0VvLf0qNZQ1t7ebpmE tlEMJ98F6EPlSrvmWoMOXdIJfwVLll8s1VkZhg3WTOlPzIS8VtiD9Yjq2RCY1qNhRv47 AFYw== X-Gm-Message-State: AOJu0Yz93agbxHvRkP1qRDl7nTO98ytFvvbnEG3xMurD4EkJBM6b+HjV Onjb8vJkC1NqnAkquSNMiQgDhmdEInv0f7utuzT4NQ== X-Google-Smtp-Source: AGHT+IGlxyKNgMgw4gPqdsM6sCdt8a29vV2ra6U+MTiFcgWggAt6F1F4Xo/APqT9ORyPK9fYbq9slw== X-Received: by 2002:a17:902:cec7:b0:1c3:76c4:7242 with SMTP id d7-20020a170902cec700b001c376c47242mr536196plg.22.1695062802658; Mon, 18 Sep 2023 11:46:42 -0700 (PDT) Received: from hermes.local (204-195-112-131.wavecable.com. [204.195.112.131]) by smtp.gmail.com with ESMTPSA id c12-20020a170903234c00b001bbfa86ca3bsm4488052plh.78.2023.09.18.11.46.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 Sep 2023 11:46:41 -0700 (PDT) From: Stephen Hemminger To: netdev@vger.kernel.org Cc: Stephen Hemminger Subject: [PATCH iproute2 2/2] ila: fix potential snprintf buffer overflow Date: Mon, 18 Sep 2023 11:46:31 -0700 Message-Id: <20230918184631.16228-2-stephen@networkplumber.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230918184631.16228-1-stephen@networkplumber.org> References: <20230918184631.16228-1-stephen@networkplumber.org> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net X-Patchwork-Delegate: dsahern@gmail.com The code to print 64 bit address has a theoretical overflow of snprintf buffer found by CodeQL scan. Address by checking result. Signed-off-by: Stephen Hemminger --- ip/ipila.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ip/ipila.c b/ip/ipila.c index 4f6d578f24ae..23b19a108862 100644 --- a/ip/ipila.c +++ b/ip/ipila.c @@ -60,6 +60,8 @@ static void print_addr64(__u64 addr, char *buff, size_t len) sep = ""; ret = snprintf(&buff[written], len - written, "%x%s", v, sep); + if (ret < 0 || ret >= len - written) + break; written += ret; } }