lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20190528205848.21208-1-vivien.didelot@gmail.com> Date: Tue, 28 May 2019 16:58:48 -0400 From: Vivien Didelot <vivien.didelot@...il.com> To: netdev@...r.kernel.org Cc: linux-kernel@...r.kernel.org, kernel@...oirfairelinux.com, Vivien Didelot <vivien.didelot@...il.com>, "David S. Miller" <davem@...emloft.net>, linville@...hat.com, f.fainelli@...il.com Subject: [PATCH net-next] ethtool: copy reglen to userspace ethtool_get_regs() allocates a buffer of size reglen obtained from ops->get_regs_len(), thus only this value must be used when copying the buffer back to userspace. Also no need to check regbuf twice. Signed-off-by: Vivien Didelot <vivien.didelot@...il.com> --- net/core/ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/core/ethtool.c b/net/core/ethtool.c index 4a593853cbf2..f3369f31d93a 100644 --- a/net/core/ethtool.c +++ b/net/core/ethtool.c @@ -1338,38 +1338,38 @@ static noinline_for_stack int ethtool_set_rxfh(struct net_device *dev, static int ethtool_get_regs(struct net_device *dev, char __user *useraddr) { struct ethtool_regs regs; const struct ethtool_ops *ops = dev->ethtool_ops; void *regbuf; int reglen, ret; if (!ops->get_regs || !ops->get_regs_len) return -EOPNOTSUPP; if (copy_from_user(®s, useraddr, sizeof(regs))) return -EFAULT; reglen = ops->get_regs_len(dev); if (reglen <= 0) return reglen; if (regs.len > reglen) regs.len = reglen; regbuf = vzalloc(reglen); if (!regbuf) return -ENOMEM; ops->get_regs(dev, ®s, regbuf); ret = -EFAULT; if (copy_to_user(useraddr, ®s, sizeof(regs))) goto out; useraddr += offsetof(struct ethtool_regs, data); - if (regbuf && copy_to_user(useraddr, regbuf, regs.len)) + if (copy_to_user(useraddr, regbuf, reglen)) goto out; ret = 0; out: vfree(regbuf); return ret; } -- 2.21.0
Powered by blists - more mailing lists