lkml.org 
[lkml]   [2018]   [Nov]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 117/160] e1000: avoid null pointer dereference on invalid stat type
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    [ Upstream commit 5983587c8c5ef00d6886477544ad67d495bc5479 ]

    Currently if the stat type is invalid then data[i] is being set
    either by dereferencing a null pointer p, or it is reading from
    an incorrect previous location if we had a valid stat type
    previously. Fix this by skipping over the read of p on an invalid
    stat type.

    Detected by CoverityScan, CID#113385 ("Explicit null dereferenced")

    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Reviewed-by: Alexander Duyck <alexander.h.duyck@intel.com>
    Tested-by: Aaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 9 ++++-----
    1 file changed, 4 insertions(+), 5 deletions(-)

    diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
    index 5ae8874bbf72..d70b2e5d5222 100644
    --- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
    +++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
    @@ -1826,11 +1826,12 @@ static void e1000_get_ethtool_stats(struct net_device *netdev,
    {
    struct e1000_adapter *adapter = netdev_priv(netdev);
    int i;
    - char *p = NULL;
    const struct e1000_stats *stat = e1000_gstrings_stats;

    e1000_update_stats(adapter);
    - for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++) {
    + for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++, stat++) {
    + char *p;
    +
    switch (stat->type) {
    case NETDEV_STATS:
    p = (char *)netdev + stat->stat_offset;
    @@ -1841,15 +1842,13 @@ static void e1000_get_ethtool_stats(struct net_device *netdev,
    default:
    WARN_ONCE(1, "Invalid E1000 stat type: %u index %d\n",
    stat->type, i);
    - break;
    + continue;
    }

    if (stat->sizeof_stat == sizeof(u64))
    data[i] = *(u64 *)p;
    else
    data[i] = *(u32 *)p;
    -
    - stat++;
    }
    /* BUG_ON(i != E1000_STATS_LEN); */
    }
    --
    2.17.1


    \
     
     \ /
      Last update: 2018-11-19 18:19    [W:4.132 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site