| From: Eric Biggers <ebiggers@google.com> |
| Date: Tue, 17 Apr 2018 12:07:06 -0700 |
| Subject: KEYS: DNS: limit the length of option strings |
| |
| commit 9c438d7a3a52dcc2b9ed095cb87d3a5e83cf7e60 upstream. |
| |
| Adding a dns_resolver key whose payload contains a very long option name |
| resulted in that string being printed in full. This hit the WARN_ONCE() |
| in set_precision() during the printk(), because printk() only supports a |
| precision of up to 32767 bytes: |
| |
| precision 1000000 too large |
| WARNING: CPU: 0 PID: 752 at lib/vsprintf.c:2189 vsnprintf+0x4bc/0x5b0 |
| |
| Fix it by limiting option strings (combined name + value) to a much more |
| reasonable 128 bytes. The exact limit is arbitrary, but currently the |
| only recognized option is formatted as "dnserror=%lu" which fits well |
| within this limit. |
| |
| Also ratelimit the printks. |
| |
| Reproducer: |
| |
| perl -e 'print "#", "A" x 1000000, "\x00"' | keyctl padd dns_resolver desc @s |
| |
| This bug was found using syzkaller. |
| |
| Reported-by: Mark Rutland <mark.rutland@arm.com> |
| Fixes: 4a2d789267e0 ("DNS: If the DNS server returns an error, allow that to be cached [ver #2]") |
| Signed-off-by: Eric Biggers <ebiggers@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| [bwh: Backported to 3.16: |
| - Also stop logging the key serial number |
| - Include <linux/ratelimit.h> directly] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| --- a/net/dns_resolver/dns_key.c |
| +++ b/net/dns_resolver/dns_key.c |
| @@ -29,6 +29,7 @@ |
| #include <linux/keyctl.h> |
| #include <linux/err.h> |
| #include <linux/seq_file.h> |
| +#include <linux/ratelimit.h> |
| #include <keys/dns_resolver-type.h> |
| #include <keys/user-type.h> |
| #include "internal.h" |
| @@ -93,10 +94,9 @@ dns_resolver_instantiate(struct key *key |
| |
| next_opt = memchr(opt, '#', end - opt) ?: end; |
| opt_len = next_opt - opt; |
| - if (!opt_len) { |
| - printk(KERN_WARNING |
| - "Empty option to dns_resolver key %d\n", |
| - key->serial); |
| + if (opt_len <= 0 || opt_len > 128) { |
| + pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n", |
| + opt_len); |
| return -EINVAL; |
| } |
| |
| @@ -130,10 +130,8 @@ dns_resolver_instantiate(struct key *key |
| } |
| |
| bad_option_value: |
| - printk(KERN_WARNING |
| - "Option '%*.*s' to dns_resolver key %d:" |
| - " bad/missing value\n", |
| - opt_nlen, opt_nlen, opt, key->serial); |
| + pr_warn_ratelimited("Option '%*.*s' to dns_resolver key: bad/missing value\n", |
| + opt_nlen, opt_nlen, opt); |
| return -EINVAL; |
| } while (opt = next_opt + 1, opt < end); |
| } |