mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-20 01:20:54 +00:00
e34f1753ee
Syzbot reported that ethnl_compact_sanity_checks() can be tricked into
reading past the end of ETHTOOL_A_BITSET_VALUE and ETHTOOL_A_BITSET_MASK
attributes and even the message by passing a value between (u32)(-31)
and (u32)(-1) as ETHTOOL_A_BITSET_SIZE.
The problem is that DIV_ROUND_UP(attr_nbits, 32) is 0 for such values so
that zero length ETHTOOL_A_BITSET_VALUE will pass the length check but
ethnl_bitmap32_not_zero() check would try to access up to 512 MB of
attribute "payload".
Prevent this overflow byt limiting the bitset size. Technically, compact
bitset format would allow bitset sizes up to almost 2^18 (so that the
nest size does not exceed U16_MAX) but bitsets used by ethtool are much
shorter. S16_MAX, the largest value which can be directly used as an
upper limit in policy, should be a reasonable compromise.
Fixes: 10b518d4e6 ("ethtool: netlink bitset handling")
Reported-by: syzbot+7fd4ed5b4234ab1fdccd@syzkaller.appspotmail.com
Reported-by: syzbot+709b7a64d57978247e44@syzkaller.appspotmail.com
Reported-by: syzbot+983cb8fb2d17a7af549d@syzkaller.appspotmail.com
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
30 lines
1.3 KiB
C
30 lines
1.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
|
|
#ifndef _NET_ETHTOOL_BITSET_H
|
|
#define _NET_ETHTOOL_BITSET_H
|
|
|
|
#define ETHNL_MAX_BITSET_SIZE S16_MAX
|
|
|
|
typedef const char (*const ethnl_string_array_t)[ETH_GSTRING_LEN];
|
|
|
|
int ethnl_bitset_is_compact(const struct nlattr *bitset, bool *compact);
|
|
int ethnl_bitset_size(const unsigned long *val, const unsigned long *mask,
|
|
unsigned int nbits, ethnl_string_array_t names,
|
|
bool compact);
|
|
int ethnl_bitset32_size(const u32 *val, const u32 *mask, unsigned int nbits,
|
|
ethnl_string_array_t names, bool compact);
|
|
int ethnl_put_bitset(struct sk_buff *skb, int attrtype,
|
|
const unsigned long *val, const unsigned long *mask,
|
|
unsigned int nbits, ethnl_string_array_t names,
|
|
bool compact);
|
|
int ethnl_put_bitset32(struct sk_buff *skb, int attrtype, const u32 *val,
|
|
const u32 *mask, unsigned int nbits,
|
|
ethnl_string_array_t names, bool compact);
|
|
int ethnl_update_bitset(unsigned long *bitmap, unsigned int nbits,
|
|
const struct nlattr *attr, ethnl_string_array_t names,
|
|
struct netlink_ext_ack *extack, bool *mod);
|
|
int ethnl_update_bitset32(u32 *bitmap, unsigned int nbits,
|
|
const struct nlattr *attr, ethnl_string_array_t names,
|
|
struct netlink_ext_ack *extack, bool *mod);
|
|
|
|
#endif /* _NET_ETHTOOL_BITSET_H */
|