GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-20 21:51:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

ethtool: Fix potential user buffer overflow for ETHTOOL_{G, S}RXFH

Browse source 
struct ethtool_rxnfc was originally defined in 2.6.27 for the
ETHTOOL_{G,S}RXFH command with only the cmd, flow_type and data
fields.  It was then extended in 2.6.30 to support various additional
commands.  These commands should have been defined to use a new
structure, but it is too late to change that now.

Since user-space may still be using the old structure definition
for the ETHTOOL_{G,S}RXFH commands, and since they do not need the
additional fields, only copy the originally defined fields to and
from user-space.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ben Hutchings 2010-06-28 08:45:58 +00:00 • committed by David S. Miller
parent db048b6903
commit bf988435bd
2 changed files with 29 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
include/linux/ethtool.h
View file

@ -379,6 +379,8 @@ struct ethtool_rxnfc {
__u32 flow_type; __u32 flow_type;
/* The rx flow hash value or the rule DB size */ /* The rx flow hash value or the rule DB size */
__u64 data; __u64 data;
/* The following fields are not valid and must not be used for
* the ETHTOOL_{G,X}RXFH commands. */
struct ethtool_rx_flow_spec fs; struct ethtool_rx_flow_spec fs;
__u32 rule_cnt; __u32 rule_cnt;
__u32 rule_locs[0]; __u32 rule_locs[0];

36
net/core/ethtool.c
View file

@ -318,23 +318,33 @@ out:
} }
static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev, static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
void __user *useraddr) u32 cmd, void __user *useraddr)
{ {
struct ethtool_rxnfc cmd; struct ethtool_rxnfc info;
size_t info_size = sizeof(info);
if (!dev->ethtool_ops->set_rxnfc) if (!dev->ethtool_ops->set_rxnfc)
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (copy_from_user(&cmd, useraddr, sizeof(cmd))) /* struct ethtool_rxnfc was originally defined for
* ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
* members. User-space might still be using that
* definition. */
if (cmd == ETHTOOL_SRXFH)
info_size = (offsetof(struct ethtool_rxnfc, data) +
sizeof(info.data));
if (copy_from_user(&info, useraddr, info_size))
return -EFAULT; return -EFAULT;
return dev->ethtool_ops->set_rxnfc(dev, &cmd); return dev->ethtool_ops->set_rxnfc(dev, &info);
} }
static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev, static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
void __user *useraddr) u32 cmd, void __user *useraddr)
{ {
struct ethtool_rxnfc info; struct ethtool_rxnfc info;
size_t info_size = sizeof(info);
const struct ethtool_ops *ops = dev->ethtool_ops; const struct ethtool_ops *ops = dev->ethtool_ops;
int ret; int ret;
void *rule_buf = NULL; void *rule_buf = NULL;
@ -342,7 +352,15 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
if (!ops->get_rxnfc) if (!ops->get_rxnfc)
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (copy_from_user(&info, useraddr, sizeof(info))) /* struct ethtool_rxnfc was originally defined for
* ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
* members. User-space might still be using that
* definition. */
if (cmd == ETHTOOL_GRXFH)
info_size = (offsetof(struct ethtool_rxnfc, data) +
sizeof(info.data));
if (copy_from_user(&info, useraddr, info_size))
return -EFAULT; return -EFAULT;
if (info.cmd == ETHTOOL_GRXCLSRLALL) { if (info.cmd == ETHTOOL_GRXCLSRLALL) {
@ -360,7 +378,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
goto err_out; goto err_out;
ret = -EFAULT; ret = -EFAULT;
if (copy_to_user(useraddr, &info, sizeof(info))) if (copy_to_user(useraddr, &info, info_size))
goto err_out; goto err_out;
if (rule_buf) { if (rule_buf) {
@ -1517,12 +1535,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
case ETHTOOL_GRXCLSRLCNT: case ETHTOOL_GRXCLSRLCNT:
case ETHTOOL_GRXCLSRULE: case ETHTOOL_GRXCLSRULE:
case ETHTOOL_GRXCLSRLALL: case ETHTOOL_GRXCLSRLALL:
rc = ethtool_get_rxnfc(dev, useraddr); rc = ethtool_get_rxnfc(dev, ethcmd, useraddr);
break; break;
case ETHTOOL_SRXFH: case ETHTOOL_SRXFH:
case ETHTOOL_SRXCLSRLDEL: case ETHTOOL_SRXCLSRLDEL:
case ETHTOOL_SRXCLSRLINS: case ETHTOOL_SRXCLSRLINS:
rc = ethtool_set_rxnfc(dev, useraddr); rc = ethtool_set_rxnfc(dev, ethcmd, useraddr);
break; break;
case ETHTOOL_GGRO: case ETHTOOL_GGRO:
rc = ethtool_get_gro(dev, useraddr); rc = ethtool_get_gro(dev, useraddr);