|
 |
87b28f |
From 5075b961a29ff9c418e1fefe78432e95dd0a5fcc Mon Sep 17 00:00:00 2001
|
|
|
87b28f |
From: Michal Schmidt <mschmidt@redhat.com>
|
|
|
87b28f |
Date: Wed, 1 Feb 2023 22:41:06 +0100
|
|
|
87b28f |
Subject: [PATCH 1/3] util: fix overflow in remap_node_name()
|
|
|
87b28f |
|
|
|
87b28f |
The function remap_node_name() assumes the parameter 'nodedesc' is at
|
|
|
87b28f |
least IB_SMP_DATA_SIZE + 1 (i.e. 65) bytes long, because it passes it to
|
|
|
87b28f |
clean_nodedesc() that writes a nul-terminator to it at offset
|
|
|
87b28f |
IB_SMP_DATA_SIZE. Callers in infiniband-diags/saquery.c pass
|
|
|
87b28f |
a (struct ib_node_desc_t).description as the argument, which is only
|
|
|
87b28f |
IB_NODE_DESCRIPTION_SIZE (i.e. 64) bytes long. This is an overflow.
|
|
|
87b28f |
|
|
|
87b28f |
An odd thing about remap_node_name() is that it may (but does not
|
|
|
87b28f |
always) rewrite the nodedesc in-place. Callers do not appear to
|
|
|
87b28f |
appreciate this behavior. Most of them are various print_* and dump_*
|
|
|
87b28f |
functions where rewriting the input makes no sense. Some callers make a
|
|
|
87b28f |
local copy of the nodedesc first, possibly to protect the original.
|
|
|
87b28f |
One caller (infiniband-diags/saquery.c:print_node_records()) checks if
|
|
|
87b28f |
either the original description or the remapped one matches a given
|
|
|
87b28f |
requested_name - so it looks like it prefers the original to be
|
|
|
87b28f |
not rewritten.
|
|
|
87b28f |
|
|
|
87b28f |
Let's make remap_node_name() a bit safer and more convenient to use.
|
|
|
87b28f |
Allocate a fixed-sized copy first. Then use strncpy to copy from
|
|
|
87b28f |
'nodedesc', never reading more than IB_SMP_DATA_SIZE (64) bytes.
|
|
|
87b28f |
Apply clean_nodedesc() on the correctly-sized copy. This solves the
|
|
|
87b28f |
overflow bug. Also, the in-place rewrite of 'nodedesc' is gone and it
|
|
|
87b28f |
can become a (const char*).
|
|
|
87b28f |
|
|
|
87b28f |
The overflow was found by a static checker (covscan).
|
|
|
87b28f |
|
|
|
87b28f |
Fixes: d974c4e398d2 ("Fix max length of node description (ibnetdiscover and smpquery)")
|
|
|
87b28f |
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
|
|
|
87b28f |
---
|
|
|
87b28f |
util/node_name_map.c | 12 +++++++++---
|
|
|
87b28f |
util/node_name_map.h | 3 +--
|
|
|
87b28f |
2 files changed, 10 insertions(+), 5 deletions(-)
|
|
|
87b28f |
|
|
|
87b28f |
diff --git a/util/node_name_map.c b/util/node_name_map.c
|
|
|
87b28f |
index 30b73eb1448e..511cb92ef19c 100644
|
|
|
87b28f |
--- a/util/node_name_map.c
|
|
|
87b28f |
+++ b/util/node_name_map.c
|
|
|
87b28f |
@@ -95,7 +95,7 @@ void close_node_name_map(nn_map_t * map)
|
|
|
87b28f |
free(map);
|
|
|
87b28f |
}
|
|
|
87b28f |
|
|
|
87b28f |
-char *remap_node_name(nn_map_t * map, uint64_t target_guid, char *nodedesc)
|
|
|
87b28f |
+char *remap_node_name(nn_map_t * map, uint64_t target_guid, const char *nodedesc)
|
|
|
87b28f |
{
|
|
|
87b28f |
char *rc = NULL;
|
|
|
87b28f |
name_map_item_t *item = NULL;
|
|
|
87b28f |
@@ -108,8 +108,14 @@ char *remap_node_name(nn_map_t * map, uint64_t target_guid, char *nodedesc)
|
|
|
87b28f |
rc = strdup(item->name);
|
|
|
87b28f |
|
|
|
87b28f |
done:
|
|
|
87b28f |
- if (rc == NULL)
|
|
|
87b28f |
- rc = strdup(clean_nodedesc(nodedesc));
|
|
|
87b28f |
+ if (rc == NULL) {
|
|
|
87b28f |
+ rc = malloc(IB_SMP_DATA_SIZE + 1);
|
|
|
87b28f |
+ if (rc) {
|
|
|
87b28f |
+ strncpy(rc, nodedesc, IB_SMP_DATA_SIZE);
|
|
|
87b28f |
+ rc[IB_SMP_DATA_SIZE] = '\0';
|
|
|
87b28f |
+ clean_nodedesc(rc);
|
|
|
87b28f |
+ }
|
|
|
87b28f |
+ }
|
|
|
87b28f |
return (rc);
|
|
|
87b28f |
}
|
|
|
87b28f |
|
|
|
87b28f |
diff --git a/util/node_name_map.h b/util/node_name_map.h
|
|
|
87b28f |
index e78d274b116e..d83d672782c4 100644
|
|
|
87b28f |
--- a/util/node_name_map.h
|
|
|
87b28f |
+++ b/util/node_name_map.h
|
|
|
87b28f |
@@ -12,8 +12,7 @@ typedef struct nn_map nn_map_t;
|
|
|
87b28f |
|
|
|
87b28f |
nn_map_t *open_node_name_map(const char *node_name_map);
|
|
|
87b28f |
void close_node_name_map(nn_map_t *map);
|
|
|
87b28f |
-/* NOTE: parameter "nodedesc" may be modified here. */
|
|
|
87b28f |
-char *remap_node_name(nn_map_t *map, uint64_t target_guid, char *nodedesc);
|
|
|
87b28f |
+char *remap_node_name(nn_map_t *map, uint64_t target_guid, const char *nodedesc);
|
|
|
87b28f |
char *clean_nodedesc(char *nodedesc);
|
|
|
87b28f |
|
|
|
87b28f |
#endif
|
|
|
87b28f |
--
|
|
|
87b28f |
2.39.1
|
|
|
87b28f |
|