1. 13 3月, 2020 14 次提交
  2. 06 3月, 2020 1 次提交
  3. 01 3月, 2020 1 次提交
  4. 27 2月, 2020 1 次提交
    • M
      ethtool: limit bitset size · e34f1753
      Michal Kubecek 提交于
      Syzbot reported that ethnl_compact_sanity_checks() can be tricked into
      reading past the end of ETHTOOL_A_BITSET_VALUE and ETHTOOL_A_BITSET_MASK
      attributes and even the message by passing a value between (u32)(-31)
      and (u32)(-1) as ETHTOOL_A_BITSET_SIZE.
      
      The problem is that DIV_ROUND_UP(attr_nbits, 32) is 0 for such values so
      that zero length ETHTOOL_A_BITSET_VALUE will pass the length check but
      ethnl_bitmap32_not_zero() check would try to access up to 512 MB of
      attribute "payload".
      
      Prevent this overflow byt limiting the bitset size. Technically, compact
      bitset format would allow bitset sizes up to almost 2^18 (so that the
      nest size does not exceed U16_MAX) but bitsets used by ethtool are much
      shorter. S16_MAX, the largest value which can be directly used as an
      upper limit in policy, should be a reasonable compromise.
      
      Fixes: 10b518d4 ("ethtool: netlink bitset handling")
      Reported-by: syzbot+7fd4ed5b4234ab1fdccd@syzkaller.appspotmail.com
      Reported-by: syzbot+709b7a64d57978247e44@syzkaller.appspotmail.com
      Reported-by: syzbot+983cb8fb2d17a7af549d@syzkaller.appspotmail.com
      Signed-off-by: NMichal Kubecek <mkubecek@suse.cz>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e34f1753
  5. 19 2月, 2020 1 次提交
  6. 17 2月, 2020 1 次提交
    • M
      ethtool: fix application of verbose no_mask bitset · 66991703
      Michal Kubecek 提交于
      A bitset without mask in a _SET request means we want exactly the bits in
      the bitset to be set. This works correctly for compact format but when
      verbose format is parsed, ethnl_update_bitset32_verbose() only sets the
      bits present in the request bitset but does not clear the rest. This can
      cause incorrect results like
      
        lion:~ # ethtool eth0 | grep Wake
                Supports Wake-on: pumbg
                Wake-on: g
        lion:~ # ethtool -s eth0 wol u
        lion:~ # ethtool eth0 | grep Wake
                Supports Wake-on: pumbg
                Wake-on: ug
      
      when the second ethtool command issues request
      
      ETHTOOL_MSG_WOL_SET
          ETHTOOL_A_WOL_HEADER
              ETHTOOL_A_HEADER_DEV_NAME = "eth0"
          ETHTOOL_A_WOL_MODES
              ETHTOOL_A_BITSET_NOMASK
              ETHTOOL_A_BITSET_BITS
                  ETHTOOL_A_BITSET_BITS_BIT
                      ETHTOOL_BITSET_BIT_INDEX = 1
      
      Fix the logic by clearing the whole target bitmap before we start iterating
      through the request bits.
      
      Fixes: 10b518d4 ("ethtool: netlink bitset handling")
      Signed-off-by: NMichal Kubecek <mkubecek@suse.cz>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      66991703
  7. 27 1月, 2020 9 次提交
  8. 09 1月, 2020 3 次提交
  9. 04 1月, 2020 1 次提交
  10. 28 12月, 2019 8 次提交