Prev: [082/140] powerpc: Fix logic error in fixup_irqs
Next: [073/205] ipvs: Add missing locking during connection table hashing and unhashing
From: Greg KH on 30 Jul 2010 14:00
2.6.33-stable review patch. If anyone has any objections, please let us know.

------------------

From: Ben Hutchings <bhutchings(a)solarflare.com>

commit db048b69037e7fa6a7d9e95a1271a50dc08ae233 upstream.

On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
overflow and the buffer may be smaller than needed. Since
ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
least denial of service.

Signed-off-by: Ben Hutchings <bhutchings(a)solarflare.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
net/core/ethtool.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -237,8 +237,9 @@ static int ethtool_get_rxnfc(struct net_

if (info.cmd == ETHTOOL_GRXCLSRLALL) {
if (info.rule_cnt > 0) {
- rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
- GFP_USER);
+ if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+ rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+ GFP_USER);
if (!rule_buf)
return -ENOMEM;
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [082/140] powerpc: Fix logic error in fixup_irqs
Next: [073/205] ipvs: Add missing locking during connection table hashing and unhashing