Commit db048b69 authored Jun 28, 2010 by Ben Hutchings Committed by David S. Miller Jun 29, 2010

ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL



On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
overflow and the buffer may be smaller than needed.  Since
ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
least denial of service.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c22d7ac8

net/core/ethtool.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -347,6 +347,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,

		if (info.cmd == ETHTOOL_GRXCLSRLALL) {
		if (info.rule_cnt > 0) {
		if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
		rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
		GFP_USER);
		if (!rule_buf)

Admin message