Re: [PATCH net v2] ethtool: fix potential userspace buffer overflow

2019-06-05 Thread David Miller
From: Vivien Didelot Date: Mon, 3 Jun 2019 16:57:13 -0400 > ethtool_get_regs() allocates a buffer of size ops->get_regs_len(), > and pass it to the kernel driver via ops->get_regs() for filling. > > There is no restriction about what the kernel drivers can or cannot do > with the open ethtool_r

Re: [PATCH net v2] ethtool: fix potential userspace buffer overflow

2019-06-05 Thread Michal Kubecek
On Mon, Jun 03, 2019 at 04:57:13PM -0400, Vivien Didelot wrote: > ethtool_get_regs() allocates a buffer of size ops->get_regs_len(), > and pass it to the kernel driver via ops->get_regs() for filling. > > There is no restriction about what the kernel drivers can or cannot do > with the open ethtoo

[PATCH net v2] ethtool: fix potential userspace buffer overflow

2019-06-03 Thread Vivien Didelot
ethtool_get_regs() allocates a buffer of size ops->get_regs_len(), and pass it to the kernel driver via ops->get_regs() for filling. There is no restriction about what the kernel drivers can or cannot do with the open ethtool_regs structure. They usually set regs->version and ignore regs->len or s