]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
.32 patches
authorGreg Kroah-Hartman <gregkh@suse.de>
Tue, 23 Nov 2010 00:53:48 +0000 (16:53 -0800)
committerGreg Kroah-Hartman <gregkh@suse.de>
Tue, 23 Nov 2010 00:53:48 +0000 (16:53 -0800)
queue-2.6.32/net-clear-heap-allocation-for-ethtool_grxclsrlall.patch [new file with mode: 0644]
queue-2.6.32/series

diff --git a/queue-2.6.32/net-clear-heap-allocation-for-ethtool_grxclsrlall.patch b/queue-2.6.32/net-clear-heap-allocation-for-ethtool_grxclsrlall.patch
new file mode 100644 (file)
index 0000000..201aacc
--- /dev/null
@@ -0,0 +1,34 @@
+From ae6df5f96a51818d6376da5307d773baeece4014 Mon Sep 17 00:00:00 2001
+From: Kees Cook <kees.cook@canonical.com>
+Date: Thu, 7 Oct 2010 10:03:48 +0000
+Subject: net: clear heap allocation for ETHTOOL_GRXCLSRLALL
+
+From: Kees Cook <kees.cook@canonical.com>
+
+commit ae6df5f96a51818d6376da5307d773baeece4014 upstream.
+
+Calling ETHTOOL_GRXCLSRLALL with a large rule_cnt will allocate kernel
+heap without clearing it. For the one driver (niu) that implements it,
+it will leave the unused portion of heap unchanged and copy the full
+contents back to userspace.
+
+Signed-off-by: Kees Cook <kees.cook@canonical.com>
+Acked-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/core/ethtool.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -265,7 +265,7 @@ static int ethtool_get_rxnfc(struct net_
+       if (info.cmd == ETHTOOL_GRXCLSRLALL) {
+               if (info.rule_cnt > 0) {
+                       if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+-                              rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
++                              rule_buf = kzalloc(info.rule_cnt * sizeof(u32),
+                                                  GFP_USER);
+                       if (!rule_buf)
+                               return -ENOMEM;
index 864f11e39cc11bd86354bcef298b155d792ec458..60041a8e0dfc2497f2f5beabf034be5582ee6db0 100644 (file)
@@ -8,3 +8,4 @@ irda-fix-heap-memory-corruption-in-iriap.c.patch
 i2c-pca-platform-change-device-name-of-request_irq.patch
 sunrpc-after-calling-xprt_release-we-must-restart-from-call_reserve.patch
 microblaze-fix-build-with-make-3.82.patch
+net-clear-heap-allocation-for-ethtool_grxclsrlall.patch