diff options
author | Wenwen Wang <wang6495@umn.edu> | 2018-04-30 12:31:13 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2018-05-01 14:18:47 -0400 |
commit | d656fe49e33df48ee6bc19e871f5862f49895c9e (patch) | |
tree | 76f01b9e3c69a0867adbc1a79107b804cf74dd6c /Makefile | |
parent | 26ff75857e5953720409ea531d42f902defb130a (diff) | |
download | linux-d656fe49e33df48ee6bc19e871f5862f49895c9e.tar.bz2 |
ethtool: fix a potential missing-check bug
In ethtool_get_rxnfc(), the object "info" is firstly copied from
user-space. If the FLOW_RSS flag is set in the member field flow_type of
"info" (and cmd is ETHTOOL_GRXFH), info needs to be copied again from
user-space because FLOW_RSS is newer and has new definition, as mentioned
in the comment. However, given that the user data resides in user-space, a
malicious user can race to change the data after the first copy. By doing
so, the user can inject inconsistent data. For example, in the second
copy, the FLOW_RSS flag could be cleared in the field flow_type of "info".
In the following execution, "info" will be used in the function
ops->get_rxnfc(). Such inconsistent data can potentially lead to unexpected
information leakage since ops->get_rxnfc() will prepare various types of
data according to flow_type, and the prepared data will be eventually
copied to user-space. This inconsistent data may also cause undefined
behaviors based on how ops->get_rxnfc() is implemented.
This patch simply re-verifies the flow_type field of "info" after the
second copy. If the value is not as expected, an error code will be
returned.
Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'Makefile')
0 files changed, 0 insertions, 0 deletions