diff options
| author | Ben Hutchings <bhutchings@solarflare.com> | 2010-06-28 08:44:07 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-06-29 01:00:29 -0700 |
| commit | db048b69037e7fa6a7d9e95a1271a50dc08ae233 (patch) | |
| tree | 0202b5d2ed643021db2790f7fae3867d3d92a1f3 | |
| parent | c22d7ac844f1cb9c6a5fd20f89ebadc2feef891b (diff) | |
| download | linux-3.10-db048b69037e7fa6a7d9e95a1271a50dc08ae233.tar.gz linux-3.10-db048b69037e7fa6a7d9e95a1271a50dc08ae233.tar.bz2 linux-3.10-db048b69037e7fa6a7d9e95a1271a50dc08ae233.zip | |
ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
overflow and the buffer may be smaller than needed. Since
ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
least denial of service.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Cc: stable@kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/core/ethtool.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/core/ethtool.c b/net/core/ethtool.c index a0f4964033d..a3a7e9a48df 100644 --- a/net/core/ethtool.c +++ b/net/core/ethtool.c @@ -347,8 +347,9 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev, if (info.cmd == ETHTOOL_GRXCLSRLALL) { if (info.rule_cnt > 0) { - rule_buf = kmalloc(info.rule_cnt * sizeof(u32), - GFP_USER); + if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32)) + rule_buf = kmalloc(info.rule_cnt * sizeof(u32), + GFP_USER); if (!rule_buf) return -ENOMEM; } |