]> git.baikalelectronics.ru Git - kernel.git/commit
KEYS: DNS: limit the length of option strings
authorEric Biggers <ebiggers@google.com>
Mon, 16 Apr 2018 21:29:22 +0000 (14:29 -0700)
committerDavid S. Miller <davem@davemloft.net>
Tue, 17 Apr 2018 17:42:58 +0000 (13:42 -0400)
commitf8526183ec1b1a76ea7574ac645b99e1e7dec151
tree965500d01e87df8c69c28e582efa98e2958013bf
parent5f3eacf2e424239c0956c0ce03d54f2624b53981
KEYS: DNS: limit the length of option strings

Adding a dns_resolver key whose payload contains a very long option name
resulted in that string being printed in full.  This hit the WARN_ONCE()
in set_precision() during the printk(), because printk() only supports a
precision of up to 32767 bytes:

    precision 1000000 too large
    WARNING: CPU: 0 PID: 752 at lib/vsprintf.c:2189 vsnprintf+0x4bc/0x5b0

Fix it by limiting option strings (combined name + value) to a much more
reasonable 128 bytes.  The exact limit is arbitrary, but currently the
only recognized option is formatted as "dnserror=%lu" which fits well
within this limit.

Also ratelimit the printks.

Reproducer:

    perl -e 'print "#", "A" x 1000000, "\x00"' | keyctl padd dns_resolver desc @s

This bug was found using syzkaller.

Reported-by: Mark Rutland <mark.rutland@arm.com>
Fixes: 492a2dbc9b95 ("DNS: If the DNS server returns an error, allow that to be cached [ver #2]")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/dns_resolver/dns_key.c