[libvirt] [PATCH v2] util: Fix stack smashing in virNetDevGetFamilyId
After commit 8708ca01c0d libvirtd consistently aborts with "stack
smashing detected" when nodedev driver is initialized.
This is caused by nlmsg_parse() being told that its array of nlattr*
has CTRL_CMD_MAX (10) entries, when in fact it is declared to have
CTRL_ATTR_MAX (8) entries. Since all the entries are initialized to
NULL, the result is that nlmsg_parse is overwriting 2*(sizof(nlattr*))
bytes outside the array.
Signed-off-by: Laine Stump <laine(a)laine.org>
---
V1 was posted by jdenemar. It fixed the problem, but it was changing
the wrong line of code:
https://www.redhat.com/archives/libvir-list/2017-September/msg00657.html
src/util/virnetdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/util/virnetdev.c b/src/util/virnetdev.c
index 41a659732..5060d051d 100644
--- a/src/util/virnetdev.c
+++ b/src/util/virnetdev.c
@@ -3183,7 +3183,7 @@ virNetDevGetFamilyId(const char *family_name)
if (virNetlinkCommand(nl_msg, &resp, &recvbuflen, 0, 0, NETLINK_GENERIC, 0)
< 0)
goto cleanup;
- if (nlmsg_parse(resp, sizeof(struct nlmsghdr), tb, CTRL_CMD_MAX, NULL) < 0) {
+ if (nlmsg_parse(resp, sizeof(struct nlmsghdr), tb, CTRL_ATTR_MAX, NULL) < 0) {
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
_("malformed netlink response message"));
goto cleanup;
--
2.13.5