diff mbox series

[5.10,04/63] ethtool: fix string set id check

Message ID	20210104155709.020311198@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+96523fb438937cd01220@syzkaller.appspotmail.com, Michal Kubecek <mkubecek@suse.cz>, Jakub Kicinski <kuba@kernel.org> Subject: [PATCH 5.10 04/63] ethtool: fix string set id check Date: Mon, 4 Jan 2021 16:56:57 +0100 Message-Id: <20210104155709.020311198@linuxfoundation.org> In-Reply-To: <20210104155708.800470590@linuxfoundation.org> References: <20210104155708.800470590@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.10,04/63] ethtool: fix string set id check [5.10,08/63] jffs2: Allow setting rp_size to zero during remounting [5.10,10/63] spi: dw-bt1: Fix undefined devm_mux_control_get symbol [5.10,11/63] opp: fix memory leak in _allocate_opp_table [5.10,12/63] opp: Call the missing clk_put() on error [5.10,13/63] scsi: block: Fix a race in the runtime power management code [5.10,15/63] mm: memmap defer init doesnt work as expected [5.10,16/63] lib/zlib: fix inflating zlib streams on s390 [5.10,17/63] io_uring: dont assume mm is constant across submits [5.10,21/63] kernel/io_uring: cancel io_uring before task works [5.10,22/63] uapi: move constants from <linux/kernel.h> to <linux/const.h> [5.10,25/63] zlib: move EXPORT_SYMBOL() and MODULE_LICENSE() out of dfltcc_syms.c [5.10,28/63] fbcon: Disable accelerated scrolling [5.10,29/63] reiserfs: add check for an invalid ih_entry_count [5.10,30/63] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_do... [5.10,34/63] ALSA: rawmidi: Access runtime->avail always in spinlock [5.10,35/63] bfs: dont use WARNING: string when its just info. [5.10,40/63] module: set MODULE_STATE_GOING state when a module fails to load [5.10,42/63] rtc: pl031: fix resource leak in pl031_probe [5.10,43/63] powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() [5.10,45/63] NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode [5.10,46/63] f2fs: avoid race condition for shrinker count [5.10,47/63] f2fs: fix race of pending_pages in decompression [5.10,48/63] module: delay kobject uevent until after module init call [5.10,49/63] powerpc/64: irq replay remove decrementer overflow check [5.10,50/63] fs/namespace.c: WARN if mnt_count has become negative [5.10,51/63] watchdog: rti-wdt: fix reference leak in rti_wdt_probe [5.10,53/63] um: ubd: Submit all data segments atomically [5.10,54/63] NFSv4.2: Dont error when exiting early on a READ_PLUS buffer overflow [5.10,56/63] drm/amd/display: updated wm table for Renoir [5.10,59/63] io_uring: remove racy overflow list fast checks [5.10,61/63] dm verity: skip verity work if I/O error when system is shutting down

Commit Message

Greg Kroah-Hartman Jan. 4, 2021, 3:56 p.m. UTC

From: Michal Kubecek <mkubecek@suse.cz>

[ Upstream commit efb796f5571f030743e1d9c662cdebdad724f8c5 ]

Syzbot reported a shift of a u32 by more than 31 in strset_parse_request()
which is undefined behavior. This is caused by range check of string set id
using variable ret (which is always 0 at this point) instead of id (string
set id from request).

Fixes: 71921690f974 ("ethtool: provide string sets with STRSET_GET request")
Reported-by: syzbot+96523fb438937cd01220@syzkaller.appspotmail.com
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Link: https://lore.kernel.org/r/b54ed5c5fd972a59afea3e1badfb36d86df68799.1607952208.git.mkubecek@suse.cz
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ethtool/strset.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/net/ethtool/strset.c
+++ b/net/ethtool/strset.c
@@ -182,7 +182,7 @@  static int strset_parse_request(struct e
 		ret = strset_get_id(attr, &id, extack);
 		if (ret < 0)
 			return ret;
-		if (ret >= ETH_SS_COUNT) {
+		if (id >= ETH_SS_COUNT) {
 			NL_SET_ERR_MSG_ATTR(extack, attr,
 					    "unknown string set id");
 			return -EOPNOTSUPP;