summaryrefslogtreecommitdiff
path: root/net/l2tp
diff options
context:
space:
mode:
authorEric Biggers <ebiggers@google.com>2018-04-17 22:07:06 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-04-29 12:33:10 +0300
commitc7a936b1dd0f75727b776479f739236a05317f7b (patch)
tree4e4605f01c50f5b8967b20132535c1a04d124916 /net/l2tp
parenta370d8a3aaf268896eabaf510e1e8ca4b7ea0a34 (diff)
downloadlinux-c7a936b1dd0f75727b776479f739236a05317f7b.tar.xz
KEYS: DNS: limit the length of option strings
[ Upstream commit 9c438d7a3a52dcc2b9ed095cb87d3a5e83cf7e60 ] Adding a dns_resolver key whose payload contains a very long option name resulted in that string being printed in full. This hit the WARN_ONCE() in set_precision() during the printk(), because printk() only supports a precision of up to 32767 bytes: precision 1000000 too large WARNING: CPU: 0 PID: 752 at lib/vsprintf.c:2189 vsnprintf+0x4bc/0x5b0 Fix it by limiting option strings (combined name + value) to a much more reasonable 128 bytes. The exact limit is arbitrary, but currently the only recognized option is formatted as "dnserror=%lu" which fits well within this limit. Also ratelimit the printks. Reproducer: perl -e 'print "#", "A" x 1000000, "\x00"' | keyctl padd dns_resolver desc @s This bug was found using syzkaller. Reported-by: Mark Rutland <mark.rutland@arm.com> Fixes: 4a2d789267e0 ("DNS: If the DNS server returns an error, allow that to be cached [ver #2]") Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/l2tp')
0 files changed, 0 insertions, 0 deletions