diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2021-05-08 16:30:35 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-06-03 10:00:38 +0300 |
| commit | caff86f85512b8e0d9830e8b8b0dfe13c68ce5b6 (patch) | |
| tree | 3c40e7bd7ba1dca7e3599f01de75ffe5e15b9f88 /net/dsa | |
| parent | b91117b66fe875723a4e79ec6263526fffdb44d2 (diff) | |
| download | linux-caff86f85512b8e0d9830e8b8b0dfe13c68ce5b6.tar.xz | |
net: dsa: fix a crash if ->get_sset_count() fails
commit a269333fa5c0c8e53c92b5a28a6076a28cde3e83 upstream.
If ds->ops->get_sset_count() fails then it "count" is a negative error
code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative
error code is type promoted to a very high value and the loop will
corrupt memory until the system crashes.
Fix this by checking for error codes and changing the type of "i" to
just int.
Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/dsa')
| -rw-r--r-- | net/dsa/master.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/net/dsa/master.c b/net/dsa/master.c index 3a44da35dfeb..45bd627b4e7b 100644 --- a/net/dsa/master.c +++ b/net/dsa/master.c @@ -147,8 +147,7 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset, struct dsa_switch *ds = cpu_dp->ds; int port = cpu_dp->index; int len = ETH_GSTRING_LEN; - int mcount = 0, count; - unsigned int i; + int mcount = 0, count, i; uint8_t pfx[4]; uint8_t *ndata; @@ -178,6 +177,8 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset, */ ds->ops->get_strings(ds, port, stringset, ndata); count = ds->ops->get_sset_count(ds, port, stringset); + if (count < 0) + return; for (i = 0; i < count; i++) { memmove(ndata + (i * len + sizeof(pfx)), ndata + i * len, len - sizeof(pfx)); |