* [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails
@ 2021-05-08 13:30 Dan Carpenter
2021-05-08 17:25 ` Andrew Lunn
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: Dan Carpenter @ 2021-05-08 13:30 UTC (permalink / raw)
To: Andrew Lunn, Florian Fainelli
Cc: Vivien Didelot, Vladimir Oltean, David S. Miller, Jakub Kicinski,
netdev, kernel-janitors
If ds->ops->get_sset_count() fails then it "count" is a negative error
code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative
error code is type promoted to a very high value and the loop will
corrupt memory until the system crashes.
Fix this by checking for error codes and changing the type of "i" to
just int.
Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
net/dsa/master.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/net/dsa/master.c b/net/dsa/master.c
index 052a977914a6..63adbc21a735 100644
--- a/net/dsa/master.c
+++ b/net/dsa/master.c
@@ -147,8 +147,7 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset,
struct dsa_switch *ds = cpu_dp->ds;
int port = cpu_dp->index;
int len = ETH_GSTRING_LEN;
- int mcount = 0, count;
- unsigned int i;
+ int mcount = 0, count, i;
uint8_t pfx[4];
uint8_t *ndata;
@@ -178,6 +177,8 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset,
*/
ds->ops->get_strings(ds, port, stringset, ndata);
count = ds->ops->get_sset_count(ds, port, stringset);
+ if (count < 0)
+ return;
for (i = 0; i < count; i++) {
memmove(ndata + (i * len + sizeof(pfx)),
ndata + i * len, len - sizeof(pfx));
--
2.30.2
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails
2021-05-08 13:30 [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails Dan Carpenter
@ 2021-05-08 17:25 ` Andrew Lunn
2021-05-08 17:31 ` Florian Fainelli
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Andrew Lunn @ 2021-05-08 17:25 UTC (permalink / raw)
To: Dan Carpenter
Cc: Florian Fainelli, Vivien Didelot, Vladimir Oltean,
David S. Miller, Jakub Kicinski, netdev, kernel-janitors
On Sat, May 08, 2021 at 04:30:35PM +0300, Dan Carpenter wrote:
> If ds->ops->get_sset_count() fails then it "count" is a negative error
> code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative
> error code is type promoted to a very high value and the loop will
> corrupt memory until the system crashes.
>
> Fix this by checking for error codes and changing the type of "i" to
> just int.
>
> Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails
2021-05-08 13:30 [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails Dan Carpenter
2021-05-08 17:25 ` Andrew Lunn
@ 2021-05-08 17:31 ` Florian Fainelli
2021-05-08 18:32 ` Vladimir Oltean
2021-05-10 21:40 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Florian Fainelli @ 2021-05-08 17:31 UTC (permalink / raw)
To: Dan Carpenter, Andrew Lunn
Cc: Vivien Didelot, Vladimir Oltean, David S. Miller, Jakub Kicinski,
netdev, kernel-janitors
On 5/8/21 6:30 AM, Dan Carpenter wrote:
> If ds->ops->get_sset_count() fails then it "count" is a negative error
> code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative
> error code is type promoted to a very high value and the loop will
> corrupt memory until the system crashes.
>
> Fix this by checking for error codes and changing the type of "i" to
> just int.
>
> Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
--
Florian
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails
2021-05-08 13:30 [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails Dan Carpenter
2021-05-08 17:25 ` Andrew Lunn
2021-05-08 17:31 ` Florian Fainelli
@ 2021-05-08 18:32 ` Vladimir Oltean
2021-05-10 21:40 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Vladimir Oltean @ 2021-05-08 18:32 UTC (permalink / raw)
To: Dan Carpenter
Cc: Andrew Lunn, Florian Fainelli, Vivien Didelot, David S. Miller,
Jakub Kicinski, netdev, kernel-janitors
On Sat, May 08, 2021 at 04:30:35PM +0300, Dan Carpenter wrote:
> If ds->ops->get_sset_count() fails then it "count" is a negative error
> code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative
> error code is type promoted to a very high value and the loop will
> corrupt memory until the system crashes.
>
> Fix this by checking for error codes and changing the type of "i" to
> just int.
>
> Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails
2021-05-08 13:30 [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails Dan Carpenter
` (2 preceding siblings ...)
2021-05-08 18:32 ` Vladimir Oltean
@ 2021-05-10 21:40 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-05-10 21:40 UTC (permalink / raw)
To: Dan Carpenter
Cc: andrew, f.fainelli, vivien.didelot, olteanv, davem, kuba, netdev,
kernel-janitors
Hello:
This patch was applied to netdev/net.git (refs/heads/master):
On Sat, 8 May 2021 16:30:35 +0300 you wrote:
> If ds->ops->get_sset_count() fails then it "count" is a negative error
> code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative
> error code is type promoted to a very high value and the loop will
> corrupt memory until the system crashes.
>
> Fix this by checking for error codes and changing the type of "i" to
> just int.
>
> [...]
Here is the summary with links:
- [net] net: dsa: fix a crash if ->get_sset_count() fails
https://git.kernel.org/netdev/net/c/a269333fa5c0
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-05-10 21:40 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-08 13:30 [PATCH net] net: dsa: fix a crash if ->get_sset_count() fails Dan Carpenter
2021-05-08 17:25 ` Andrew Lunn
2021-05-08 17:31 ` Florian Fainelli
2021-05-08 18:32 ` Vladimir Oltean
2021-05-10 21:40 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).