summaryrefslogtreecommitdiffstats
path: root/drivers/net/niu.c
diff options
context:
space:
mode:
authorBen Hutchings <bhutchings@solarflare.com>2010-09-07 04:35:19 +0000
committerDavid S. Miller <davem@davemloft.net>2010-09-08 14:01:52 -0700
commitee9c5cfad29c8a13199962614b9b16f1c4137ac9 (patch)
tree12c53593c04b2c443029fe1a4b64393b3e6e92b9 /drivers/net/niu.c
parent6523ce1525e88c598c75a1a6b8c4edddfa9defe8 (diff)
downloadlinux-ee9c5cfad29c8a13199962614b9b16f1c4137ac9.tar.gz
linux-ee9c5cfad29c8a13199962614b9b16f1c4137ac9.tar.bz2
linux-ee9c5cfad29c8a13199962614b9b16f1c4137ac9.zip
niu: Fix kernel buffer overflow for ETHTOOL_GRXCLSRLALL
niu_get_ethtool_tcam_all() assumes that its output buffer is the right size, and warns before returning if it is not. However, the output buffer size is under user control and ETHTOOL_GRXCLSRLALL is an unprivileged ethtool command. Therefore this is at least a local denial-of-service vulnerability. Change it to check before writing each entry and to return an error if the buffer is already full. Compile-tested only. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/niu.c')
-rw-r--r--drivers/net/niu.c16
1 files changed, 6 insertions, 10 deletions
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index b9b950845b0e..340cbec48943 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -7272,32 +7272,28 @@ static int niu_get_ethtool_tcam_all(struct niu *np,
struct niu_parent *parent = np->parent;
struct niu_tcam_entry *tp;
int i, idx, cnt;
- u16 n_entries;
unsigned long flags;
-
+ int ret = 0;
/* put the tcam size here */
nfc->data = tcam_get_size(np);
niu_lock_parent(np, flags);
- n_entries = nfc->rule_cnt;
for (cnt = 0, i = 0; i < nfc->data; i++) {
idx = tcam_get_index(np, i);
tp = &parent->tcam[idx];
if (!tp->valid)
continue;
+ if (cnt == nfc->rule_cnt) {
+ ret = -EMSGSIZE;
+ break;
+ }
rule_locs[cnt] = i;
cnt++;
}
niu_unlock_parent(np, flags);
- if (n_entries != cnt) {
- /* print warning, this should not happen */
- netdev_info(np->dev, "niu%d: In %s(): n_entries[%d] != cnt[%d]!!!\n",
- np->parent->index, __func__, n_entries, cnt);
- }
-
- return 0;
+ return ret;
}
static int niu_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,