AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2024-11-24 05:40:55 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

net: dsa: fix a crash if ->get_sset_count() fails

Browse Source 
commit a269333fa5c0c8e53c92b5a28a6076a28cde3e83 upstream.

If ds->ops->get_sset_count() fails then it "count" is a negative error
code such as -EOPNOTSUPP.  Because "i" is an unsigned int, the negative
error code is type promoted to a very high value and the loop will
corrupt memory until the system crashes.

Fix this by checking for error codes and changing the type of "i" to
just int.

Fixes: badf3ada60 ("net: dsa: Provide CPU port statistics to master netdev")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2021-05-08 16:30:35 +03:00 committed by Greg Kroah-Hartman
parent b91117b66f
commit caff86f855
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/dsa/master.c
View File

@ -147,8 +147,7 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset,
struct dsa_switch *ds = cpu_dp->ds; struct dsa_switch *ds = cpu_dp->ds;
int port = cpu_dp->index; int port = cpu_dp->index;
int len = ETH_GSTRING_LEN; int len = ETH_GSTRING_LEN;
int mcount = 0, count; int mcount = 0, count, i;
unsigned int i;
uint8_t pfx[4]; uint8_t pfx[4];
uint8_t *ndata; uint8_t *ndata;
@ -178,6 +177,8 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset,
*/ */
ds->ops->get_strings(ds, port, stringset, ndata); ds->ops->get_strings(ds, port, stringset, ndata);
count = ds->ops->get_sset_count(ds, port, stringset); count = ds->ops->get_sset_count(ds, port, stringset);
if (count < 0)
return;
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
memmove(ndata + (i * len + sizeof(pfx)), memmove(ndata + (i * len + sizeof(pfx)),
ndata + i * len, len - sizeof(pfx)); ndata + i * len, len - sizeof(pfx));