After commit 8708ca01c0d libvirtd consistently aborts with "stack
 smashing detected" when nodedev driver is initialized.

This is caused by nlmsg_parse() being told that its array of nlattr*
has CTRL_CMD_MAX (10) entries, when in fact it is declared to have
CTRL_ATTR_MAX (8) entries. Since all the entries are initialized to
NULL, the result is that nlmsg_parse is overwriting 2*(sizof(nlattr*))
bytes outside the array.

Signed-off-by: Laine Stump <laine@laine.org>
---

V1 was posted by jdenemar. It fixed the problem, but it was changing
the wrong line of code:

  https://www.redhat.com/archives/libvir-list/2017-September/msg00657.html

 src/util/virnetdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c
index 41a659732..5060d051d 100644
--- a/src/util/virnetdev.c
+++ b/src/util/virnetdev.c
@@ -3183,7 +3183,7 @@ virNetDevGetFamilyId(const char *family_name)
     if (virNetlinkCommand(nl_msg, &resp, &recvbuflen, 0, 0, NETLINK_GENERIC, 0) < 0)
         goto cleanup;
 
-    if (nlmsg_parse(resp, sizeof(struct nlmsghdr), tb, CTRL_CMD_MAX, NULL) < 0) {
+    if (nlmsg_parse(resp, sizeof(struct nlmsghdr), tb, CTRL_ATTR_MAX, NULL) < 0) {
         virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
                        _("malformed netlink response message"));
         goto cleanup;
-- 
2.13.5

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On 09/21/2017 01:57 PM, Laine Stump wrote:
> After commit 8708ca01c0d libvirtd consistently aborts with "stack
>  smashing detected" when nodedev driver is initialized.
> 
> This is caused by nlmsg_parse() being told that its array of nlattr*
> has CTRL_CMD_MAX (10) entries, when in fact it is declared to have
> CTRL_ATTR_MAX (8) entries. Since all the entries are initialized to
> NULL, the result is that nlmsg_parse is overwriting 2*(sizof(nlattr*))
> bytes outside the array.
> 
> Signed-off-by: Laine Stump <laine@laine.org>
> ---
> 
> V1 was posted by jdenemar. It fixed the problem, but it was changing
> the wrong line of code:
> 
>   https://www.redhat.com/archives/libvir-list/2017-September/msg00657.html
> 

Reviewed-by: John Ferlan <jferlan@redhat.com>

John

(or ACK if you prefer - I'm just so used to the R-b now)


--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

On Thu, Sep 21, 2017 at 15:25:37 -0400, John Ferlan wrote:
> 
> 
> On 09/21/2017 01:57 PM, Laine Stump wrote:
> > After commit 8708ca01c0d libvirtd consistently aborts with "stack
> >  smashing detected" when nodedev driver is initialized.
> > 
> > This is caused by nlmsg_parse() being told that its array of nlattr*
> > has CTRL_CMD_MAX (10) entries, when in fact it is declared to have
> > CTRL_ATTR_MAX (8) entries. Since all the entries are initialized to
> > NULL, the result is that nlmsg_parse is overwriting 2*(sizof(nlattr*))
> > bytes outside the array.
> > 
> > Signed-off-by: Laine Stump <laine@laine.org>
> > ---
> > 
> > V1 was posted by jdenemar. It fixed the problem, but it was changing
> > the wrong line of code:
> > 
> >   https://www.redhat.com/archives/libvir-list/2017-September/msg00657.html
> > 
> 
> Reviewed-by: John Ferlan <jferlan@redhat.com>
> 
> John
> 
> (or ACK if you prefer - I'm just so used to the R-b now)

I pushed this patch.

Jirka

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list