diff options
| author | Ben Hutchings <bhutchings@solarflare.com> | 2010-09-07 04:35:19 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-09-08 14:01:52 -0700 |
| commit | ee9c5cfad29c8a13199962614b9b16f1c4137ac9 (patch) | |
| tree | 12c53593c04b2c443029fe1a4b64393b3e6e92b9 /drivers/net | |
| parent | 6523ce1525e88c598c75a1a6b8c4edddfa9defe8 (diff) | |
| download | op-kernel-dev-ee9c5cfad29c8a13199962614b9b16f1c4137ac9.zip op-kernel-dev-ee9c5cfad29c8a13199962614b9b16f1c4137ac9.tar.gz | |
niu: Fix kernel buffer overflow for ETHTOOL_GRXCLSRLALL
niu_get_ethtool_tcam_all() assumes that its output buffer is the right
size, and warns before returning if it is not. However, the output
buffer size is under user control and ETHTOOL_GRXCLSRLALL is an
unprivileged ethtool command. Therefore this is at least a local
denial-of-service vulnerability.
Change it to check before writing each entry and to return an error if
the buffer is already full.
Compile-tested only.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/niu.c | 16 |
1 files changed, 6 insertions, 10 deletions
diff --git a/drivers/net/niu.c b/drivers/net/niu.c index b9b9508..340cbec 100644 --- a/drivers/net/niu.c +++ b/drivers/net/niu.c @@ -7272,32 +7272,28 @@ static int niu_get_ethtool_tcam_all(struct niu *np, struct niu_parent *parent = np->parent; struct niu_tcam_entry *tp; int i, idx, cnt; - u16 n_entries; unsigned long flags; - + int ret = 0; /* put the tcam size here */ nfc->data = tcam_get_size(np); niu_lock_parent(np, flags); - n_entries = nfc->rule_cnt; for (cnt = 0, i = 0; i < nfc->data; i++) { idx = tcam_get_index(np, i); tp = &parent->tcam[idx]; if (!tp->valid) continue; + if (cnt == nfc->rule_cnt) { + ret = -EMSGSIZE; + break; + } rule_locs[cnt] = i; cnt++; } niu_unlock_parent(np, flags); - if (n_entries != cnt) { - /* print warning, this should not happen */ - netdev_info(np->dev, "niu%d: In %s(): n_entries[%d] != cnt[%d]!!!\n", - np->parent->index, __func__, n_entries, cnt); - } - - return 0; + return ret; } static int niu_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd, |
