| Message ID | YJaSe3RPgn7gKxZv@mwanda |
|---|---|
| State | New |
| Headers | show |
| Series | [net] net: dsa: fix a crash if ->get_sset_count() fails | expand |
Hello: This patch was applied to netdev/net.git (refs/heads/master): On Sat, 8 May 2021 16:30:35 +0300 you wrote: > If ds->ops->get_sset_count() fails then it "count" is a negative error > code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative > error code is type promoted to a very high value and the loop will > corrupt memory until the system crashes. > > Fix this by checking for error codes and changing the type of "i" to > just int. > > [...] Here is the summary with links: - [net] net: dsa: fix a crash if ->get_sset_count() fails https://git.kernel.org/netdev/net/c/a269333fa5c0 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/dsa/master.c b/net/dsa/master.c index 052a977914a6..63adbc21a735 100644 --- a/net/dsa/master.c +++ b/net/dsa/master.c @@ -147,8 +147,7 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset, struct dsa_switch *ds = cpu_dp->ds; int port = cpu_dp->index; int len = ETH_GSTRING_LEN; - int mcount = 0, count; - unsigned int i; + int mcount = 0, count, i; uint8_t pfx[4]; uint8_t *ndata; @@ -178,6 +177,8 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset, */ ds->ops->get_strings(ds, port, stringset, ndata); count = ds->ops->get_sset_count(ds, port, stringset); + if (count < 0) + return; for (i = 0; i < count; i++) { memmove(ndata + (i * len + sizeof(pfx)), ndata + i * len, len - sizeof(pfx));
If ds->ops->get_sset_count() fails then it "count" is a negative error code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative error code is type promoted to a very high value and the loop will corrupt memory until the system crashes. Fix this by checking for error codes and changing the type of "i" to just int. Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- net/dsa/master.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)