lkml.org 
[lkml]   [2010]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[057/165] ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Ben Hutchings <bhutchings@solarflare.com>

    commit db048b69037e7fa6a7d9e95a1271a50dc08ae233 upstream.

    On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
    overflow and the buffer may be smaller than needed. Since
    ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
    least denial of service.

    Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/core/ethtool.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/net/core/ethtool.c
    +++ b/net/core/ethtool.c
    @@ -244,8 +244,9 @@ static int ethtool_get_rxnfc(struct net_

    if (info.cmd == ETHTOOL_GRXCLSRLALL) {
    if (info.rule_cnt > 0) {
    - rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
    - GFP_USER);
    + if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
    + rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
    + GFP_USER);
    if (!rule_buf)
    return -ENOMEM;
    }



    \
     
     \ /
      Last update: 2010-07-30 21:09    [W:0.024 / U:0.188 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site