aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBen Hutchings <bhutchings@solarflare.com>2010-06-28 08:44:07 +0000
committerDavid S. Miller <davem@davemloft.net>2010-06-29 01:00:29 -0700
commitdb048b69037e7fa6a7d9e95a1271a50dc08ae233 (patch)
tree0202b5d2ed643021db2790f7fae3867d3d92a1f3
parentc22d7ac844f1cb9c6a5fd20f89ebadc2feef891b (diff)
downloadlinux-2.6.34-ux500-db048b69037e7fa6a7d9e95a1271a50dc08ae233.tar.gz
ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer overflow and the buffer may be smaller than needed. Since ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at least denial of service. Signed-off-by: Ben Hutchings <bhutchings@solarflare.com> Cc: stable@kernel.org Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--net/core/ethtool.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index a0f4964033d..a3a7e9a48df 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -347,8 +347,9 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
if (info.cmd == ETHTOOL_GRXCLSRLALL) {
if (info.rule_cnt > 0) {
- rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
- GFP_USER);
+ if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+ rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+ GFP_USER);
if (!rule_buf)
return -ENOMEM;
}