83 lines
2.6 KiB
Diff
83 lines
2.6 KiB
Diff
From patchwork Tue Dec 6 02:10:58 2016
|
|
Content-Type: text/plain; charset="utf-8"
|
|
MIME-Version: 1.0
|
|
Content-Transfer-Encoding: 7bit
|
|
Subject: virtio-net: Fix DMA-from-the-stack in virtnet_set_mac_address()
|
|
From: Andy Lutomirski <luto@kernel.org>
|
|
X-Patchwork-Id: 702984
|
|
X-Patchwork-Delegate: davem@davemloft.net
|
|
Message-Id: <fe889e578d5dffa9ae0834b449a35fcfd1e10694.1480990173.git.luto@kernel.org>
|
|
To: netdev@vger.kernel.org
|
|
Cc: linux-kernel@vger.kernel.org, virtualization@lists.linux-foundation.org,
|
|
Andy Lutomirski <luto@kernel.org>,
|
|
"Michael S . Tsirkin" <mst@redhat.com>, Jason Wang <jasowang@redhat.com>,
|
|
Laura Abbott <labbott@redhat.com>
|
|
Date: Mon, 5 Dec 2016 18:10:58 -0800
|
|
|
|
With CONFIG_VMAP_STACK=y, virtnet_set_mac_address() can be passed a
|
|
pointer to the stack and it will OOPS. Copy the address to the heap
|
|
to prevent the crash.
|
|
|
|
Cc: Michael S. Tsirkin <mst@redhat.com>
|
|
Cc: Jason Wang <jasowang@redhat.com>
|
|
Cc: Laura Abbott <labbott@redhat.com>
|
|
Reported-by: zbyszek@in.waw.pl
|
|
Signed-off-by: Andy Lutomirski <luto@kernel.org>
|
|
Acked-by: Jason Wang <jasowang@redhat.com>
|
|
Acked-by: Michael S. Tsirkin <mst@redhat.com>
|
|
---
|
|
|
|
Very lightly tested.
|
|
|
|
drivers/net/virtio_net.c | 19 ++++++++++++++-----
|
|
1 file changed, 14 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
|
|
index 7276d5a95bd0..cbf1c613c67a 100644
|
|
--- a/drivers/net/virtio_net.c
|
|
+++ b/drivers/net/virtio_net.c
|
|
@@ -969,12 +969,17 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
|
|
struct virtnet_info *vi = netdev_priv(dev);
|
|
struct virtio_device *vdev = vi->vdev;
|
|
int ret;
|
|
- struct sockaddr *addr = p;
|
|
+ struct sockaddr *addr;
|
|
struct scatterlist sg;
|
|
|
|
- ret = eth_prepare_mac_addr_change(dev, p);
|
|
+ addr = kmalloc(sizeof(*addr), GFP_KERNEL);
|
|
+ if (!addr)
|
|
+ return -ENOMEM;
|
|
+ memcpy(addr, p, sizeof(*addr));
|
|
+
|
|
+ ret = eth_prepare_mac_addr_change(dev, addr);
|
|
if (ret)
|
|
- return ret;
|
|
+ goto out;
|
|
|
|
if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR)) {
|
|
sg_init_one(&sg, addr->sa_data, dev->addr_len);
|
|
@@ -982,7 +987,8 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
|
|
VIRTIO_NET_CTRL_MAC_ADDR_SET, &sg)) {
|
|
dev_warn(&vdev->dev,
|
|
"Failed to set mac address by vq command.\n");
|
|
- return -EINVAL;
|
|
+ ret = -EINVAL;
|
|
+ goto out;
|
|
}
|
|
} else if (virtio_has_feature(vdev, VIRTIO_NET_F_MAC) &&
|
|
!virtio_has_feature(vdev, VIRTIO_F_VERSION_1)) {
|
|
@@ -996,8 +1002,11 @@ static int virtnet_set_mac_address(struct net_device *dev, void *p)
|
|
}
|
|
|
|
eth_commit_mac_addr_change(dev, p);
|
|
+ ret = 0;
|
|
|
|
- return 0;
|
|
+out:
|
|
+ kfree(addr);
|
|
+ return ret;
|
|
}
|
|
|
|
static struct rtnl_link_stats64 *virtnet_stats(struct net_device *dev,
|