From: "John W. Linville" <linville@tuxdriver.com>
To: Michal Kubecek <mkubecek@suse.cz>
Cc: netdev@vger.kernel.org,
Raju Lakkaraju <Raju.Lakkaraju@microsemi.com>,
"Allan W. Nielsen" <allan.nielsen@microsemi.com>
Subject: Re: [PATCH ethtool] ethtool: fix stack clash in do_get_phy_tunable and do_set_phy_tunable
Date: Thu, 31 May 2018 13:51:27 -0400 [thread overview]
Message-ID: <20180531175127.GA27980@tuxdriver.com> (raw)
In-Reply-To: <20180509120146.C7408A0C6F@unicorn.suse.cz>
On Wed, May 09, 2018 at 02:01:46PM +0200, Michal Kubecek wrote:
> Users reported stack clash detected when using --get-phy-tunable on
> ppc64le. Problem is caused by local variable ds of type struct
> ethtool_tunable which has last member "void *data[0]". Accessing data[0]
> (as do_get_phy_tunable() does) or adding requested value at the end (which
> is what kernel ioctl does) writes past allocated space for the variable.
>
> Make ds part of an anonymous structure to make sure there is enough space
> for tunable value and drop the (pointless) access to ds.data[0]. The same
> problem also exists in do_set_phy_tunable().
>
> Fixes: b0fe96dec90f ("Ethtool: Implements ETHTOOL_PHY_GTUNABLE/ETHTOOL_PHY_STUNABLE and PHY downshift")
> Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
LGTM -- queued for next release...
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
prev parent reply other threads:[~2018-05-31 18:00 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-09 12:01 [PATCH ethtool] ethtool: fix stack clash in do_get_phy_tunable and do_set_phy_tunable Michal Kubecek
2018-05-31 17:51 ` John W. Linville [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180531175127.GA27980@tuxdriver.com \
--to=linville@tuxdriver.com \
--cc=Raju.Lakkaraju@microsemi.com \
--cc=allan.nielsen@microsemi.com \
--cc=mkubecek@suse.cz \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.