Close "fd" file descriptor when is goes out of scope so it does
not leak.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 5b8f28f..d55ce40 10
Check return value of strchr call and dereference it only if it is
not NULL.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 81cbb6e..5b8f28f 100644
--- a
Check return value of poll call and if it fails print error
to the system log. If errno is EINVAL then exit with non-zero
value otherwise continue the while loop and call poll again.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 11 ++-
1 file changed, 10 insertions(+), 1
Check return value of setsockopt call and if it fails print error
to the system log and exit with non-zero value.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 8 +++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv
Previous patches 1/4 and 2/4 contained an error (missing comma)
that prevented the patched source to be built.
Patches are based on linux-next (20130522) tree.
Tomas Hozza (4):
tools: hv: Check return value of setsockopt call
tools: hv: Check return value of poll call
tools: hv: Check
Check return value of poll call and if it fails print error
to the system log. If errno is EINVAL then exit with non-zero
value otherwise continue the while loop and call poll again.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 11 ++-
1 file changed, 10 insertions(+), 1
Check return value of setsockopt call and if it fails print error
to the system log and exit with non-zero value.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 8 +++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv
Close "fd" file descriptor when is goes out of scope so it does
not leak.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 6 +-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 468ca16..3dbc2eb 10
Check return value of strchr call and dereference it only if it is
not NULL.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 554abd1..468ca16 100644
--- a
Check return value of poll call and if it fails print error
to the system log. If errno is EINVAL then exit with non-zero
value otherwise continue the while loop and call poll again.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 11 ++-
1 file changed, 10 insertions(+), 1
Check return value of setsockopt call and if it fails print error
to the system log and exit with non-zero value.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 8 +++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv
- Original Message -
> 于 2013年03月19日 16:58, Tomas Hozza 写道:
> > - Original Message -
> >>> -Original Message-----
> >>> From: Tomas Hozza [mailto:tho...@redhat.com]
> >>> Sent: Monday, March 18, 2013 11:39 AM
> >>> To:
- Original Message -
> > -Original Message-
> > From: Tomas Hozza [mailto:tho...@redhat.com]
> > Sent: Monday, March 18, 2013 11:39 AM
> > To: KY Srinivasan
> > Cc: Jason Wang
> > Subject: Re: Can HyperV KVP daemon detect if running under Window
HyperV KVP daemon should check nlmsg_type in received netlink message
header. If message type is NLMSG_DONE daemon can proceed with processing
otherwise it should wait for next message.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 4
1 file changed, 4 insertions(+)
diff --git
HyperV daemon should use macros for option values when calling setsockopt.
Using specific numeric values instead of macros is confusing.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 10 +++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/tools/hv
" which is used by CGroup Rules Engine Daemon. This caused the
daemon to segfault (at least on 2.6.32 kernel).
HyperV daemon should set nl_groups to zero and specify multicast
group CN_KVP_IDX only by using socket options.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 4 ++--
eed for handling the
> > truncation
> > case.
>
> You are claiming two contradictory things: sprintf() may overrun the
> buffer, so we need the length check provided by snprintf(), but there
> is no need to check for truncation because we know t
- Original Message -
> On Tue, 2012-11-27 at 08:56 +0100, Tomas Hozza wrote:
> > kvp_get_if_name and kvp_mac_to_if_name copy strings into statically
> > sized buffers which could be too small to store really long names.
> >
> > Buffer sizes have been c
Initial patch by Ben Hutchings
We will install this in /usr, so it must use /var/lib for its state.
Only programs installed under /opt should use /var/opt.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 12 ++--
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a
Hutchings
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index e266251..7105c7b 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -2
ned-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 26 +-
1 file changed, 9 insertions(+), 17 deletions(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index d25a469..90f1f07 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -
Hello.
Just FYI there is already a CVE name CVE-2012-5532 for this issue.
Regards,
Tomas Hozza
- Original Message -
> On Thu, Nov 08, 2012 at 10:53:29AM +0100, Tomas Hozza wrote:
> > The source code without this patch caused hypervkvpd to exit when
> > it processed
> &
- Original Message -
> On Thu, Nov 08, 2012 at 10:53:29AM +0100, Tomas Hozza wrote:
> > The source code without this patch caused hypervkvpd to exit when
> > it processed
> > a spoofed Netlink packet which has been sent from an untrusted
> > local user.
> >
Hutchings
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index a581b3f..17703c7 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -2
Initial patch by Ben Hutchings
We will install this in /usr, so it must use /var/lib for its state.
Only programs installed under /opt should use /var/opt.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 12 ++--
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a
Initial patch by Ben Hutchings
Standard C strings are arrays of char, not __u8 (unsigned char).
Declare variables and parameters accordingly, and add the necessary
casts.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 10 +-
1 file changed, 5 insertions(+), 5 deletions
Initial patch by Ben Hutchings
We will install this in /usr, so it must use /var/lib for its state.
Only programs installed under /opt should use /var/opt.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 10 +-
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a
Hutchings
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 573b9aa..9609858 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -2
ned-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 26 +-
1 file changed, 9 insertions(+), 17 deletions(-)
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index 13c2a14..54ecb95 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -
> > -char dev_id[256];
> > +char dev_id[512];
>
> Shouldnt that be PATH_MAX or similar?
dirent->d_name should be PATH_MAX, but it is mostly
not guaranteed. And then the dev_id is concatenated
with two strings so it can exceed 256 bytes.
After discussion with K. Y. Srinivasan I j
kvp_get_if_name and kvp_mac_to_if_name copy strings into statically
sized buffers which could be too small to store really long names.
Buffer sizes have been increased and length checks added via snprintf.
Signed-off-by: Tomas Hozza
---
tools/hv/hv_kvp_daemon.c | 25
The source code without this patch caused hypervkvpd to exit when it processed
a spoofed Netlink packet which has been sent from an untrusted local user.
Now Netlink messages with a non-zero nl_pid source address are ignored
and a warning is printed into the syslog.
Signed-off-by: Tomas Hozza
>From 6199072f8131056efce208f04e6985d1f9968d8e Mon Sep 17 00:00:00 2001
From: Tomas Hozza
Date: Mon, 5 Nov 2012 10:08:16 +0100
Subject: [PATCH] Netlink source address validation allows DoS
The source code without this patch caused hypervkvpd to exit when it processed
a spoofed Netlink pac
acket which has been sent
from an untrusted local user.
This patch is fixing this, so now the Netlink messages with a non-zero
nl_pid source address are just ignored.
Regards,
Tomas Hozza
Associate Software Engineer
BaseOS - Brno, CZ
From 6199072f8131056efce208f04e6985d1f9968d8e Mon Sep 17 00:
34 matches
Mail list logo
