netdev - Re: [PATCH net] ethtool: Fix NULL pointer dereference during module EEPROM dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9fddace5-09a2-6cc1-30c7-3f31ce9e2ceb@nvidia.com>
Date:   Mon, 7 Jun 2021 08:28:12 +0300
From:   Moshe Shemesh <moshe@...dia.com>
To:     Ido Schimmel <idosch@...sch.org>, <netdev@...r.kernel.org>
CC:     <davem@...emloft.net>, <kuba@...nel.org>, <mkubecek@...e.cz>,
        <vladyslavt@...dia.com>, <andrew@...n.ch>, <mlxsw@...dia.com>,
        Ido Schimmel <idosch@...dia.com>
Subject: Re: [PATCH net] ethtool: Fix NULL pointer dereference during module
 EEPROM dump


On 6/6/2021 5:24 PM, Ido Schimmel wrote:
> From: Ido Schimmel <idosch@...dia.com>
>
> When get_module_eeprom_by_page() is not implemented by the driver, NULL
> pointer dereference can occur [1].
>
> Fix by testing if get_module_eeprom_by_page() is implemented instead of
> get_module_info().
>
> [1]
>   BUG: kernel NULL pointer dereference, address: 0000000000000000
>   [...]
>   CPU: 0 PID: 251 Comm: ethtool Not tainted 5.13.0-rc3-custom-00940-g3822d0670c9d #989
>   Call Trace:
>    eeprom_prepare_data+0x101/0x2d0
>    ethnl_default_doit+0xc2/0x290
>    genl_family_rcv_msg_doit+0xdc/0x140
>    genl_rcv_msg+0xd7/0x1d0
>    netlink_rcv_skb+0x49/0xf0
>    genl_rcv+0x1f/0x30
>    netlink_unicast+0x1f6/0x2c0
>    netlink_sendmsg+0x1f9/0x400
>    __sys_sendto+0xe1/0x130
>    __x64_sys_sendto+0x1b/0x20
>    do_syscall_64+0x3a/0x70
>    entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> Fixes: c97a31f66ebc ("ethtool: wire in generic SFP module access")
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> ---
>   net/ethtool/eeprom.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ethtool/eeprom.c b/net/ethtool/eeprom.c
> index 2a6733a6449a..5d38e90895ac 100644
> --- a/net/ethtool/eeprom.c
> +++ b/net/ethtool/eeprom.c
> @@ -95,7 +95,7 @@ static int get_module_eeprom_by_page(struct net_device *dev,
>          if (dev->sfp_bus)
>                  return sfp_get_module_eeprom_by_page(dev->sfp_bus, page_data, extack);
>
> -       if (ops->get_module_info)
> +       if (ops->get_module_eeprom_by_page)
>                  return ops->get_module_eeprom_by_page(dev, page_data, extack);
>
>          return -EOPNOTSUPP;
> --
> 2.31.1


Acked-by: Moshe Shemesh <moshe@...dia.com>