| Message ID | f6b5c29f-ca07-a6a0-6e94-6b52dc56407b@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | [net-next] ethtool: prevent endless loop if eeprom size is smaller than announced | expand |
Hello: This patch was applied to netdev/net-next.git (refs/heads/master): On Mon, 13 Sep 2021 21:58:26 +0200 you wrote: > It shouldn't happen, but can happen that readable eeprom size is smaller > than announced. Then we would be stuck in an endless loop here because > after reaching the actual end reads return eeprom.len = 0. I faced this > issue when making a mistake in driver development. Detect this scenario > and return an error. > > Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> > > [...] Here is the summary with links: - [net-next] ethtool: prevent endless loop if eeprom size is smaller than announced https://git.kernel.org/netdev/net-next/c/b9bbc4c1debc You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html
diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index f2abc3152..999e2a6be 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -1537,6 +1537,10 @@ static int ethtool_get_any_eeprom(struct net_device *dev, void __user *useraddr, ret = getter(dev, &eeprom, data); if (ret) break; + if (!eeprom.len) { + ret = -EIO; + break; + } if (copy_to_user(userbuf, data, eeprom.len)) { ret = -EFAULT; break;
It shouldn't happen, but can happen that readable eeprom size is smaller than announced. Then we would be stuck in an endless loop here because after reaching the actual end reads return eeprom.len = 0. I faced this issue when making a mistake in driver development. Detect this scenario and return an error. Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com> --- net/ethtool/ioctl.c | 4 ++++ 1 file changed, 4 insertions(+)