From: Ben Hutchings <bhutchings@solarflare.com>
Date: Mon, 28 Jun 2010 08:44:07 +0000 (+0000)
Subject: ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL
X-Git-Tag: v2.6.33.7~60
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=300a7b4c1e3bbb3bd5e5db9af0a059f521f00789;p=thirdparty%2Fkernel%2Fstable.git

ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL

commit db048b69037e7fa6a7d9e95a1271a50dc08ae233 upstream.

On a 32-bit machine, info.rule_cnt >= 0x40000000 leads to integer
overflow and the buffer may be smaller than needed.  Since
ETHTOOL_GRXCLSRLALL is unprivileged, this can presumably be used for at
least denial of service.

Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 236a9988ea914..65a9b2ef64552 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -237,8 +237,9 @@ static int ethtool_get_rxnfc(struct net_device *dev, void __user *useraddr)
 
 	if (info.cmd == ETHTOOL_GRXCLSRLALL) {
 		if (info.rule_cnt > 0) {
-			rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
-					   GFP_USER);
+			if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+				rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+						   GFP_USER);
 			if (!rule_buf)
 				return -ENOMEM;
 		}