Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-07-18 08:26:13 +0200
committerJiri Slaby <jslaby@suse.cz>2019-07-18 09:30:36 +0200
commit185825154198bb6f630138a4bf50a2b0a873c045 (patch)
treecf25a7109026855e0ca7d371c1cef41a278ffde4
parent19f2ac5590e2e7e189cf443f7d906e5aaebbd652 (diff)
ethtool: fix potential userspace buffer overflow
(networking-stable-19_06_09).
-rw-r--r--patches.suse/ethtool-fix-potential-userspace-buffer-overflow.patch52
-rw-r--r--series.conf1
2 files changed, 53 insertions, 0 deletions
diff --git a/patches.suse/ethtool-fix-potential-userspace-buffer-overflow.patch b/patches.suse/ethtool-fix-potential-userspace-buffer-overflow.patch
new file mode 100644
index 0000000000..d67ec9a7cb
--- /dev/null
+++ b/patches.suse/ethtool-fix-potential-userspace-buffer-overflow.patch
@@ -0,0 +1,52 @@
+From: Vivien Didelot <vivien.didelot@gmail.com>
+Date: Mon, 3 Jun 2019 16:57:13 -0400
+Subject: ethtool: fix potential userspace buffer overflow
+Git-commit: 0ee4e76937d69128a6a66861ba393ebdc2ffc8a2
+Patch-mainline: 5.2-rc4
+References: networking-stable-19_06_09
+
+ethtool_get_regs() allocates a buffer of size ops->get_regs_len(),
+and pass it to the kernel driver via ops->get_regs() for filling.
+
+There is no restriction about what the kernel drivers can or cannot do
+with the open ethtool_regs structure. They usually set regs->version
+and ignore regs->len or set it to the same size as ops->get_regs_len().
+
+But if userspace allocates a smaller buffer for the registers dump,
+we would cause a userspace buffer overflow in the final copy_to_user()
+call, which uses the regs.len value potentially reset by the driver.
+
+To fix this, make this case obvious and store regs.len before calling
+ops->get_regs(), to only copy as much data as requested by userspace,
+up to the value returned by ops->get_regs_len().
+
+While at it, remove the redundant check for non-null regbuf.
+
+Signed-off-by: Vivien Didelot <vivien.didelot@gmail.com>
+Reviewed-by: Michal Kubecek <mkubecek@suse.cz>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/core/ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1427,13 +1427,16 @@ static int ethtool_get_regs(struct net_d
+ return -ENOMEM;
+ }
+
++ if (regs.len < reglen)
++ reglen = regs.len;
++
+ ops->get_regs(dev, &regs, regbuf);
+
+ ret = -EFAULT;
+ if (copy_to_user(useraddr, &regs, sizeof(regs)))
+ goto out;
+ useraddr += offsetof(struct ethtool_regs, data);
+- if (regbuf && copy_to_user(useraddr, regbuf, regs.len))
++ if (copy_to_user(useraddr, regbuf, reglen))
+ goto out;
+ ret = 0;
+
diff --git a/series.conf b/series.conf
index 373146ca3a..98a7948660 100644
--- a/series.conf
+++ b/series.conf
@@ -22710,6 +22710,7 @@
patches.fixes/fuse-fallocate-fix-return-with-locked-inode.patch
patches.fixes/s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-udev-event
patches.suse/Fix-memory-leak-in-sctp_process_init.patch
+ patches.suse/ethtool-fix-potential-userspace-buffer-overflow.patch
patches.drivers/net-mvpp2-Use-strscpy-to-handle-stat-strings.patch
patches.fixes/pktgen-do-not-sleep-with-the-thread-lock-held.patch
patches.drivers/hwmon-core-add-thermal-sensors-only-if-dev-of_node-i.patch