[PATCH iproute2] rttable: Fix invalid range checking when table id is converted to u32

Subsystems: library code, the rest

STALE3511d

2 messages, 2 authors, 2017-01-13 · open the first message on its own page

[PATCH iproute2] rttable: Fix invalid range checking when table id is converted to u32

From: David Ahern <hidden>
Date: 2017-01-10 23:34:01

Frank reported that table ids for very large numbers are not properly
detected:
$ ip li add foobar type vrf table 98765432100123456789

command succeeds and resulting table id is actually:

21: foobar: <NOARP,MASTER> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether da:ea:d4:77:38:2a brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 4294967295 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535

Make the temp variable 'i' unsigned long and let the typecast to u32
happen on assignment to id.

Reported-by: Frank Kellermann <redacted>
Signed-off-by: David Ahern <redacted>
---
 lib/rt_names.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/rt_names.c b/lib/rt_names.c
index c66cb1e439e3..63687586508b 100644
--- a/lib/rt_names.c
+++ b/lib/rt_names.c
@@ -404,7 +404,7 @@ int rtnl_rttable_a2n(__u32 *id, const char *arg)
 	static unsigned long res;
 	struct rtnl_hash_entry *entry;
 	char *end;
-	__u32 i;
+	unsigned long i;
 
 	if (cache && strcmp(cache, arg) == 0) {
 		*id = res;
-- 
2.1.4

Re: [PATCH iproute2] rttable: Fix invalid range checking when table id is converted to u32

From: Stephen Hemminger <stephen@networkplumber.org>
Date: 2017-01-13 01:36:23

On Tue, 10 Jan 2017 15:33:55 -0800
David Ahern [off-list ref] wrote:
Frank reported that table ids for very large numbers are not properly
detected:
$ ip li add foobar type vrf table 98765432100123456789

command succeeds and resulting table id is actually:

21: foobar: <NOARP,MASTER> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether da:ea:d4:77:38:2a brd ff:ff:ff:ff:ff:ff promiscuity 0
    vrf table 4294967295 addrgenmode eui64 numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535

Make the temp variable 'i' unsigned long and let the typecast to u32
happen on assignment to id.

Reported-by: Frank Kellermann <redacted>
Signed-off-by: David Ahern <redacted>
Applied thanks.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help