netdev - Re: [PATCH ethtool] ethtool: fix stack clash in do_get_phy_tunable and do_set_phy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 31 May 2018 13:51:27 -0400
From:   "John W. Linville" <linville@...driver.com>
To:     Michal Kubecek <mkubecek@...e.cz>
Cc:     netdev@...r.kernel.org,
        Raju Lakkaraju <Raju.Lakkaraju@...rosemi.com>,
        "Allan W. Nielsen" <allan.nielsen@...rosemi.com>
Subject: Re: [PATCH ethtool] ethtool: fix stack clash in do_get_phy_tunable
 and do_set_phy_tunable

On Wed, May 09, 2018 at 02:01:46PM +0200, Michal Kubecek wrote:
> Users reported stack clash detected when using --get-phy-tunable on
> ppc64le. Problem is caused by local variable ds of type struct
> ethtool_tunable which has last member "void *data[0]". Accessing data[0]
> (as do_get_phy_tunable() does) or adding requested value at the end (which
> is what kernel ioctl does) writes past allocated space for the variable.
> 
> Make ds part of an anonymous structure to make sure there is enough space
> for tunable value and drop the (pointless) access to ds.data[0]. The same
> problem also exists in do_set_phy_tunable().
> 
> Fixes: b0fe96dec90f ("Ethtool: Implements ETHTOOL_PHY_GTUNABLE/ETHTOOL_PHY_STUNABLE and PHY downshift")
> Signed-off-by: Michal Kubecek <mkubecek@...e.cz>

LGTM -- queued for next release...

-- 
John W. Linville		Someday the world will need a hero, and you
linville@...driver.com			might be all we have.  Be ready.