| Message ID | 20200517172053.GA734488@decadent.org.uk |
|---|---|
| State | New |
| Headers | show |
| Series | [net] mlx4: Fix information leak on failure to read module EEPROM | expand |
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c index 8a5ea2543670..6edc3177af1c 100644 --- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c @@ -2078,14 +2078,17 @@ static int mlx4_en_get_module_eeprom(struct net_device *dev, ret = mlx4_get_module_info(mdev->dev, priv->port, offset, ee->len - i, data + i); - if (!ret) /* Done reading */ + if (!ret) { + /* DOM was not readable after all */ + memset(data + i, 0, ee->len - i); return 0; + } if (ret < 0) { en_err(priv, "mlx4_get_module_info i(%d) offset(%d) bytes_to_read(%d) - FAILED (0x%x)\n", i, offset, ee->len - i, ret); - return 0; + return ret; } i += ret;
mlx4_en_get_module_eeprom() returns 0 even if it fails. This results in copying an uninitialised (or partly initialised) buffer back to user-space. Change it so that: * In the special case that the DOM turns out not to be readable, the remaining part of the buffer is cleared. This should avoid a regression when reading modules with this problem. * In other error cases, the error code is propagated. Reported-by: Yannis Aribaud <bugs@d6bell.net> References: https://bugs.debian.org/960702 Fixes: 7202da8b7f71 ("ethtool, net/mlx4_en: Cable info, get_module_info/...") Signed-off-by: Ben Hutchings <ben@decadent.org.uk> --- This is compile-tested only. It should go to stable, if it is a correct fix. Ben. drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)