All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Austin Kim <austindh.kim@gmail.com>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 11/26] net: ethtool: clear heap allocations for ethtool function
Date: Mon, 21 Jun 2021 13:53:44 -0400	[thread overview]
Message-ID: <20210621175400.735800-11-sashal@kernel.org> (raw)
In-Reply-To: <20210621175400.735800-1-sashal@kernel.org>

From: Austin Kim <austindh.kim@gmail.com>

[ Upstream commit 80ec82e3d2c1fab42eeb730aaa7985494a963d3f ]

Several ethtool functions leave heap uncleared (potentially) by
drivers. This will leave the unused portion of heap unchanged and
might copy the full contents back to userspace.

Signed-off-by: Austin Kim <austindh.kim@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/ethtool.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 76506975d59a..cbd1885f2459 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1508,7 +1508,7 @@ static int ethtool_get_any_eeprom(struct net_device *dev, void __user *useraddr,
 	if (eeprom.offset + eeprom.len > total_len)
 		return -EINVAL;
 
-	data = kmalloc(PAGE_SIZE, GFP_USER);
+	data = kzalloc(PAGE_SIZE, GFP_USER);
 	if (!data)
 		return -ENOMEM;
 
@@ -1573,7 +1573,7 @@ static int ethtool_set_eeprom(struct net_device *dev, void __user *useraddr)
 	if (eeprom.offset + eeprom.len > ops->get_eeprom_len(dev))
 		return -EINVAL;
 
-	data = kmalloc(PAGE_SIZE, GFP_USER);
+	data = kzalloc(PAGE_SIZE, GFP_USER);
 	if (!data)
 		return -ENOMEM;
 
@@ -1764,7 +1764,7 @@ static int ethtool_self_test(struct net_device *dev, char __user *useraddr)
 		return -EFAULT;
 
 	test.len = test_len;
-	data = kmalloc_array(test_len, sizeof(u64), GFP_USER);
+	data = kcalloc(test_len, sizeof(u64), GFP_USER);
 	if (!data)
 		return -ENOMEM;
 
@@ -2295,7 +2295,7 @@ static int ethtool_get_tunable(struct net_device *dev, void __user *useraddr)
 	ret = ethtool_tunable_valid(&tuna);
 	if (ret)
 		return ret;
-	data = kmalloc(tuna.len, GFP_USER);
+	data = kzalloc(tuna.len, GFP_USER);
 	if (!data)
 		return -ENOMEM;
 	ret = ops->get_tunable(dev, &tuna, data);
@@ -2481,7 +2481,7 @@ static int get_phy_tunable(struct net_device *dev, void __user *useraddr)
 	ret = ethtool_phy_tunable_valid(&tuna);
 	if (ret)
 		return ret;
-	data = kmalloc(tuna.len, GFP_USER);
+	data = kzalloc(tuna.len, GFP_USER);
 	if (!data)
 		return -ENOMEM;
 	mutex_lock(&phydev->lock);
-- 
2.30.2


  parent reply	other threads:[~2021-06-21 17:59 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-21 17:53 [PATCH AUTOSEL 5.4 01/26] dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc() Sasha Levin
2021-06-21 17:53 ` Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 02/26] mac80211: remove warning in ieee80211_get_sband() Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 03/26] mac80211_hwsim: drop pending frames on stop Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 04/26] cfg80211: call cfg80211_leave_ocb when switching away from OCB Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 05/26] dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe() Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 06/26] dmaengine: mediatek: free the proper desc in desc_free handler Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 07/26] dmaengine: mediatek: do not issue a new desc if one is still current Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 08/26] dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 09/26] net: ipv4: Remove unneed BUG() function Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 10/26] mac80211: drop multicast fragments Sasha Levin
2021-06-21 17:53 ` Sasha Levin [this message]
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 12/26] ping: Check return value of function 'ping_queue_rcv_skb' Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 13/26] inet: annotate date races around sk->sk_txhash Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 14/26] net: phy: dp83867: perform soft reset and retain established link Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 15/26] net: caif: fix memory leak in ldisc_open Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 16/26] net/packet: annotate accesses to po->bind Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 17/26] net/packet: annotate accesses to po->ifindex Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 18/26] r8152: Avoid memcpy() over-reading of ETH_SS_STATS Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 19/26] sh_eth: " Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 20/26] r8169: " Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 21/26] KVM: selftests: Fix kvm_check_cap() assertion Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 22/26] net: qed: Fix memcpy() overflow of qed_dcbx_params() Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 23/26] recordmcount: Correct st_shndx handling Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 24/26] PCI: Add AMD RS690 quirk to enable 64-bit DMA Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 25/26] net: ll_temac: Add memory-barriers for TX BD access Sasha Levin
2021-06-21 17:53   ` Sasha Levin
2021-06-21 17:53 ` [PATCH AUTOSEL 5.4 26/26] net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY Sasha Levin
2021-06-21 17:53   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210621175400.735800-11-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=austindh.kim@gmail.com \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.