All statistics related commands from ifdata has some bug resulting in
program termination.
$ ifdata -si enp65s0f0np0
*** stack smashing detected ***: terminated
Aborted (core dumped)
$ ifdata -sop enp65s0f0np0
*** stack smashing detected ***: terminated
Aborted (core dumped)
iproute2:
$ ip -s l
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
RX: bytes packets errors dropped missed mcast
4308703779 24336016 0 0 0 0
TX: bytes packets errors dropped carrier collsns
4308703779 24336016 0 0 0 0
2: enp7s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
link/ether 00:d8:61:11:11:12 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped missed mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 2 0 0
altname enx00d8610db52f
3: enp8s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
link/ether 00:d8:61:11:11:13 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped missed mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 2 0 0
altname enx00d8610db530
4: enp65s0f0np0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 64:9d:99:11:11:22 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped missed mcast
233345799977 186982026 0 16906 0 100445
TX: bytes packets errors dropped carrier collsns
20761404438 35581611 0 0 0 0
altname enx649d99ffee34
5: enp65s0f1np1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN mode DEFAULT group default qlen 1000
link/ether 64:9d:99:11:11:11 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped missed mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 2 0 0
altname enx649d99ffee35
6: lxcbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
link/ether 10:66:6a:00:00:00 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped missed mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 2658 0 0
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
link/ether 02:42:bc:11:11:11 brd ff:ff:ff:ff:ff:ff
RX: bytes packets errors dropped missed mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 294 0 0
$
Many other commands from ifdata work fine.
Regards,
Witold
Hello, I tried to track this down, and it originates from a fscanf in get_stats, which tries to put the interface name into the "char name[10]" variable. I was able to reproduce it inside a VM by attaching a virtual usb network adapter, which gets a 15 bytes interface name ((qemu) device_add usb-net,id=usb-net1). A package built with attached patch no longer shows the stack smashing. Kind regards, Bernhard (rr) bt #0 0x00007fd71a387f25 in __vfscanf_internal (s=<optimized out>, format=<optimized out>, argptr=argptr@entry=0x7ffde7e7a7d0, mode_flags=mode_flags@entry=2) at ./stdio-common/vfscanf-internal.c:3020 #1 0x00007fd71a3785e9 in __isoc99_fscanf (stream=stream@entry=0x562293989350, format=format@entry=0x562255d75078 " %20[^:]:%llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu %llu") at ./stdio-common/isoc99_fscanf.c:30 #2 0x0000562255d73d78 in get_stats (iface=iface@entry=0x7ffde7e7bdc9 "enx405400123457") at ./ifdata.c:291 #3 0x0000562255d732e5 in main (argc=3, argv=0x7ffde7e7ab68) at ./ifdata.c:576
Thanks a lot! According to Linux's kernels netif_set_alias() [1,2], it would make sense to increase it even to IFALIASZ (currently: 256). I am planning to forward a patch to upstream within this week; or do you want to do it yourself? Kind regards, Nicolas [1]: net/core/dev.c (Linux v6.17-rc6) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/core/dev.c?h=v6.17-rc6#n1512 [2]: include/uapi/linux/if.h (Linux v6.17-rc6) https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/if.h?h=v6.17-rc6#n35
Am 22.09.25 um 16:30 schrieb Nicolas Schier: Hello Nicolas, thanks for taking a look. If kernel allows names that long I guess this tool should also use this length, yes. Would be great if you could forward it to upstream, I am not really sure where to send it. Kind regards, Bernhard
But I have to correct my own reply: IFALIASZ is irrelevant, as ifdata only parses /proc/net/dev, thus the POSIX default IFNAMSIZ is the maximum string lenght (including NULL terminator). I have not yet found a fscanf() format string that incorporates the compile-time variable string length that still looks kind of beautiful. Hard-coding to a concrete integer (like 10 as it is or 20 as you suggested) is for sure still possible but does not look "right" to me. I'll try to find a nicer solution... Kind regards, Nicolas
Extend the hard-coded interface name length limit in ifdata to the POSIX
compliant maximum length of (IFNAMSIZ) when reading from /proc/net/dev.
Witold Baryluk and Bernhard Übelacker reported that interface names
longer than 10 characters caused stack smashing of `ifdata`. Extend the
hard-coded 10 bytes limitation to IFNAMSIZ.
Reported-by: Witold Baryluk <witold.baryluk@gmail.com>
Reported-by: Bernhard Übelacker <bernhardu@mailbox.org>
Closes: https://bugs.debian.org/1107470
Signed-off-by: Nicolas Schier <nicolas@fjasle.eu>
---
ifdata.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/ifdata.c b/ifdata.c
index 6e0bd0b..feeabac 100644
--- a/ifdata.c
+++ b/ifdata.c
@@ -267,10 +267,13 @@ static void skipline(FILE *fd) {
} while (ch != '\n' && ch != EOF);
}
+#define ___stringify_(x) #x
+#define __stringify(x) ___stringify_(x)
+
struct if_stat *get_stats(const char *iface) {
FILE *fd;
struct if_stat *ifstat;
- char name[10];
+ char name[IFNAMSIZ+1];
if (!(ifstat = malloc(sizeof(struct if_stat)))) {
perror("malloc");
@@ -289,7 +292,8 @@ struct if_stat *get_stats(const char *iface) {
do {
int items = fscanf(fd,
- " %20[^:]:%llu %llu %llu %llu %llu %llu %llu %llu "
+ " %" __stringify(IFNAMSIZ) "[^:]:"
+ "%llu %llu %llu %llu %llu %llu %llu %llu "
"%llu %llu %llu %llu %llu %llu %llu %llu",
name,
&ifstat->in_bytes, &ifstat->in_packets,