34 lines
1.3 KiB
Diff
34 lines
1.3 KiB
Diff
From: Ben Hutchings <bhutchings@solarflare.com>
|
|
Date: Mon, 28 Jun 2010 08:44:07 +0000 (+0000)
|
|
Subject: ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
|
|
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fdavem%2Fnet-2.6.git;a=commitdiff_plain;h=db048b69037e7fa6a7d9e95a1271a50dc08ae233
|
|
|
|
ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
|
|
|
|
On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
|
|
overflow and the buffer may be smaller than needed. Since
|
|
ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
|
|
least denial of service.
|
|
|
|
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
|
|
Cc: stable@kernel.org
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
---
|
|
|
|
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
|
|
index a0f4964..a3a7e9a 100644
|
|
--- a/net/core/ethtool.c
|
|
+++ b/net/core/ethtool.c
|
|
@@ -347,8 +347,9 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
|
|
|
|
if (info.cmd == ETHTOOL_GRXCLSRLALL) {
|
|
if (info.rule_cnt > 0) {
|
|
- rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
|
|
- GFP_USER);
|
|
+ if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
|
|
+ rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
|
|
+ GFP_USER);
|
|
if (!rule_buf)
|
|
return -ENOMEM;
|
|
}
|