diff options
| author | Ben Hutchings <bhutchings@solarflare.com> | 2010-09-07 04:35:19 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-05-09 15:55:39 -0700 |
| commit | ffa7db22639e3df2c335691b9b0abbcba7ae18ed (patch) | |
| tree | f5c06bd6c86b95face72b2997e3c54b339ab0ebe /net/lapb/lapb_subr.c | |
| parent | 252056213a0e7d5386836f755f319117252a1451 (diff) | |
niu: Fix kernel buffer overflow for ETHTOOL_GRXCLSRLALL
commit ee9c5cfad29c8a13199962614b9b16f1c4137ac9 upstream.
niu_get_ethtool_tcam_all() assumes that its output buffer is the right
size, and warns before returning if it is not. However, the output
buffer size is under user control and ETHTOOL_GRXCLSRLALL is an
unprivileged ethtool command. Therefore this is at least a local
denial-of-service vulnerability.
Change it to check before writing each entry and to return an error if
the buffer is already full.
Compile-tested only.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[Adjusted to apply to 2.6.32 by dann frazier <dannf@debian.org>]
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net/lapb/lapb_subr.c')
0 files changed, 0 insertions, 0 deletions