| From db048b69037e7fa6a7d9e95a1271a50dc08ae233 Mon Sep 17 00:00:00 2001 |
| From: Ben Hutchings <bhutchings@solarflare.com> |
| Date: Mon, 28 Jun 2010 08:44:07 +0000 |
| Subject: ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL |
| |
| From: Ben Hutchings <bhutchings@solarflare.com> |
| |
| commit db048b69037e7fa6a7d9e95a1271a50dc08ae233 upstream. |
| |
| On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer |
| overflow and the buffer may be smaller than needed. Since |
| ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at |
| least denial of service. |
| |
| Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/core/ethtool.c | 5 +++-- |
| 1 file changed, 3 insertions(+), 2 deletions(-) |
| |
| --- a/net/core/ethtool.c |
| +++ b/net/core/ethtool.c |
| @@ -237,8 +237,9 @@ static int ethtool_get_rxnfc(struct net_ |
| |
| if (info.cmd == ETHTOOL_GRXCLSRLALL) { |
| if (info.rule_cnt > 0) { |
| - rule_buf = kmalloc(info.rule_cnt * sizeof(u32), |
| - GFP_USER); |
| + if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32)) |
| + rule_buf = kmalloc(info.rule_cnt * sizeof(u32), |
| + GFP_USER); |
| if (!rule_buf) |
| return -ENOMEM; |
| } |
