Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Eric Biggers 0f546b6809 KEYS: DNS: limit the length of option strings ... commit 9c438d7a3a upstream. Adding a dns_resolver key whose payload contains a very long option name resulted in that string being printed in full. This hit the WARN_ONCE() in set_precision() during the printk(), because printk() only supports a precision of up to 32767 bytes: precision 1000000 too large WARNING: CPU: 0 PID: 752 at lib/vsprintf.c:2189 vsnprintf+0x4bc/0x5b0 Fix it by limiting option strings (combined name + value) to a much more reasonable 128 bytes. The exact limit is arbitrary, but currently the only recognized option is formatted as "dnserror=%lu" which fits well within this limit. Also ratelimit the printks. Reproducer: perl -e 'print "#", "A" x 1000000, "\x00"' | keyctl padd dns_resolver desc @s This bug was found using syzkaller. Reported-by: Mark Rutland <mark.rutland@arm.com> Fixes: 4a2d789267 ("DNS: If the DNS server returns an error, allow that to be cached [ver #2]") Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> [bwh: Backported to 3.16: - Also stop logging the key serial number - Include <linux/ratelimit.h> directly] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		History 2018-10-21 08:45:30 +01:00
..
dns_key.c	KEYS: DNS: limit the length of option strings	2018-10-21 08:45:30 +01:00
dns_query.c	dns_resolver: Null-terminate the right string	2014-07-20 22:33:32 -07:00
internal.h	net/*: Fix FSF address in file headers	2013-12-06 12:37:57 -05:00
Kconfig	[DNS RESOLVER] Minor typo correction	2010-08-06 03:18:09 +00:00
Makefile	Net: dns_resolver: Makefile: Remove deprecated kbuild goal definitions	2010-11-22 08:16:10 -08:00