| Message ID | 20211126175543.28000-1-jwi@linux.ibm.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 0276af2176c78771da7f311621a25d7608045827 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() | expand |
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Fri, 26 Nov 2021 18:55:43 +0100 you wrote: > ethtool_set_coalesce() now uses both the .get_coalesce() and > .set_coalesce() callbacks. But the check for their availability is > buggy, so changing the coalesce settings on a device where the driver > provides only _one_ of the callbacks results in a NULL pointer > dereference instead of an -EOPNOTSUPP. > > Fix the condition so that the availability of both callbacks is > ensured. This also matches the netlink code. > > [...] Here is the summary with links: - [net] ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() https://git.kernel.org/netdev/net/c/0276af2176c7 You are awesome, thank you!
diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 65e9bc1058b5..20bcf86970ff 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -1719,7 +1719,7 @@ static noinline_for_stack int ethtool_set_coalesce(struct net_device *dev, struct ethtool_coalesce coalesce; int ret; - if (!dev->ethtool_ops->set_coalesce && !dev->ethtool_ops->get_coalesce) + if (!dev->ethtool_ops->set_coalesce || !dev->ethtool_ops->get_coalesce) return -EOPNOTSUPP; ret = dev->ethtool_ops->get_coalesce(dev, &coalesce, &kernel_coalesce,
ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability is buggy, so changing the coalesce settings on a device where the driver provides only _one_ of the callbacks results in a NULL pointer dereference instead of an -EOPNOTSUPP. Fix the condition so that the availability of both callbacks is ensured. This also matches the netlink code. Note that reproducing this requires some effort - it only affects the legacy ioctl path, and needs a specific combination of driver options: - have .get_coalesce() and .coalesce_supported but no .set_coalesce(), or - have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't cause the crash as it first attempts to call ethtool_get_coalesce() and bails out on error. Fixes: f3ccfda19319 ("ethtool: extend coalesce setting uAPI with CQE mode") Cc: Yufeng Mo <moyufeng@huawei.com> Cc: Huazhong Tan <tanhuazhong@huawei.com> Cc: Andrew Lunn <andrew@lunn.ch> Cc: Heiner Kallweit <hkallweit1@gmail.com> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> --- net/ethtool/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)