From: Joel Granados via B4 Relay <devnull+j.granados.samsung.com@xxxxxxxxxx> Date: Fri, 12 Apr 2024 16:48:32 +0200 > From: Joel Granados <j.granados@xxxxxxxxxxx> > > This commit comes at the tail end of a greater effort to remove the > empty elements at the end of the ctl_table arrays (sentinels) which will > reduce the overall build time size of the kernel and run time memory > bloat by ~64 bytes per sentinel (further information Link : > https://lore.kernel.org/all/ZO5Yx5JFogGi%2FcBo@xxxxxxxxxxxxxxxxxxxxxx/) > > Avoid a buffer overflow when traversing the ctl_table by ensuring that > AX25_MAX_VALUES is the same as the size of ax25_param_table. This is > done with a BUILD_BUG_ON where ax25_param_table is defined and a > CONFIG_AX25_DAMA_SLAVE guard in the unnamed enum definition as well as > in the ax25_dev_device_up and ax25_ds_set_timer functions. > > The overflow happened when the sentinel was removed from > ax25_param_table. The sentinel's data element was changed when > CONFIG_AX25_DAMA_SLAVE was undefined. This had no adverse effects as it > still stopped on the sentinel's null procname but needed to be addressed > once the sentinel was removed. > > Signed-off-by: Joel Granados <j.granados@xxxxxxxxxxx> Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> > --- > include/net/ax25.h | 2 ++ > net/ax25/ax25_dev.c | 3 +++ > net/ax25/ax25_ds_timer.c | 4 ++++ > net/ax25/sysctl_net_ax25.c | 3 +-- > 4 files changed, 10 insertions(+), 2 deletions(-) > > diff --git a/include/net/ax25.h b/include/net/ax25.h > index 0d939e5aee4e..eb9cee8252c8 100644 > --- a/include/net/ax25.h > +++ b/include/net/ax25.h > @@ -139,7 +139,9 @@ enum { > AX25_VALUES_N2, /* Default N2 value */ > AX25_VALUES_PACLEN, /* AX.25 MTU */ > AX25_VALUES_PROTOCOL, /* Std AX.25, DAMA Slave, DAMA Master */ > +#ifdef CONFIG_AX25_DAMA_SLAVE > AX25_VALUES_DS_TIMEOUT, /* DAMA Slave timeout */ > +#endif > AX25_MAX_VALUES /* THIS MUST REMAIN THE LAST ENTRY OF THIS LIST */ > }; > > diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c > index c5462486dbca..af547e185a94 100644 > --- a/net/ax25/ax25_dev.c > +++ b/net/ax25/ax25_dev.c > @@ -78,7 +78,10 @@ void ax25_dev_device_up(struct net_device *dev) > ax25_dev->values[AX25_VALUES_N2] = AX25_DEF_N2; > ax25_dev->values[AX25_VALUES_PACLEN] = AX25_DEF_PACLEN; > ax25_dev->values[AX25_VALUES_PROTOCOL] = AX25_DEF_PROTOCOL; > + > +#ifdef CONFIG_AX25_DAMA_SLAVE > ax25_dev->values[AX25_VALUES_DS_TIMEOUT]= AX25_DEF_DS_TIMEOUT; > +#endif > > #if defined(CONFIG_AX25_DAMA_SLAVE) || defined(CONFIG_AX25_DAMA_MASTER) > ax25_ds_setup_timer(ax25_dev); > diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c > index c4f8adbf8144..8f385d2a7628 100644 > --- a/net/ax25/ax25_ds_timer.c > +++ b/net/ax25/ax25_ds_timer.c > @@ -49,12 +49,16 @@ void ax25_ds_del_timer(ax25_dev *ax25_dev) > > void ax25_ds_set_timer(ax25_dev *ax25_dev) > { > +#ifdef CONFIG_AX25_DAMA_SLAVE > if (ax25_dev == NULL) /* paranoia */ > return; > > ax25_dev->dama.slave_timeout = > msecs_to_jiffies(ax25_dev->values[AX25_VALUES_DS_TIMEOUT]) / 10; > mod_timer(&ax25_dev->dama.slave_timer, jiffies + HZ); > +#else > + return; > +#endif > } > > /* > diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c > index db66e11e7fe8..fb9966926e90 100644 > --- a/net/ax25/sysctl_net_ax25.c > +++ b/net/ax25/sysctl_net_ax25.c > @@ -141,8 +141,6 @@ static const struct ctl_table ax25_param_table[] = { > .extra2 = &max_ds_timeout > }, > #endif > - > - { } /* that's all, folks! */ > }; > > int ax25_register_dev_sysctl(ax25_dev *ax25_dev) > @@ -155,6 +153,7 @@ int ax25_register_dev_sysctl(ax25_dev *ax25_dev) > if (!table) > return -ENOMEM; > > + BUILD_BUG_ON(AX25_MAX_VALUES != ARRAY_SIZE(ax25_param_table)); > for (k = 0; k < AX25_MAX_VALUES; k++) > table[k].data = &ax25_dev->values[k]; > > > -- > 2.43.0
