Eric Biggers 9c438d7a3a KEYS: DNS: limit the length of option strings ...

Adding a dns_resolver key whose payload contains a very long option name
resulted in that string being printed in full.  This hit the WARN_ONCE()
in set_precision() during the printk(), because printk() only supports a
precision of up to 32767 bytes:

    precision 1000000 too large
    WARNING: CPU: 0 PID: 752 at lib/vsprintf.c:2189 vsnprintf+0x4bc/0x5b0

Fix it by limiting option strings (combined name + value) to a much more
reasonable 128 bytes.  The exact limit is arbitrary, but currently the
only recognized option is formatted as "dnserror=%lu" which fits well
within this limit.

Also ratelimit the printks.

Reproducer:

    perl -e 'print "#", "A" x 1000000, "\x00"' | keyctl padd dns_resolver desc @s

This bug was found using syzkaller.

Reported-by: Mark Rutland <[email protected]>
Fixes: 4a2d789267 ("DNS: If the DNS server returns an error, allow that to be cached [ver #2]")
Signed-off-by: Eric Biggers <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

2018-04-17 15:17:41 -04:00

..

dns_key.c

KEYS: DNS: limit the length of option strings

2018-04-17 15:17:41 -04:00

dns_query.c

afs: Support the AFS dynamic root

2018-02-06 14:43:37 +00:00

internal.h

KEYS: Merge the type-specific data with the payload data

2015-10-21 15:18:36 +01:00

Kconfig

…

Makefile

…