From mboxrd@z Thu Jan 1 00:00:00 1970 From: "John W. Linville" Subject: Re: [PATCH ethtool] ethtool: fix stack clash in do_get_phy_tunable and do_set_phy_tunable Date: Thu, 31 May 2018 13:51:27 -0400 Message-ID: <20180531175127.GA27980@tuxdriver.com> References: <20180509120146.C7408A0C6F@unicorn.suse.cz> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: netdev@vger.kernel.org, Raju Lakkaraju , "Allan W. Nielsen" To: Michal Kubecek Return-path: Received: from charlotte.tuxdriver.com ([70.61.120.58]:45775 "EHLO smtp.tuxdriver.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932864AbeEaSAR (ORCPT ); Thu, 31 May 2018 14:00:17 -0400 Content-Disposition: inline In-Reply-To: <20180509120146.C7408A0C6F@unicorn.suse.cz> Sender: netdev-owner@vger.kernel.org List-ID: On Wed, May 09, 2018 at 02:01:46PM +0200, Michal Kubecek wrote: > Users reported stack clash detected when using --get-phy-tunable on > ppc64le. Problem is caused by local variable ds of type struct > ethtool_tunable which has last member "void *data[0]". Accessing data[0] > (as do_get_phy_tunable() does) or adding requested value at the end (which > is what kernel ioctl does) writes past allocated space for the variable. > > Make ds part of an anonymous structure to make sure there is enough space > for tunable value and drop the (pointless) access to ds.data[0]. The same > problem also exists in do_set_phy_tunable(). > > Fixes: b0fe96dec90f ("Ethtool: Implements ETHTOOL_PHY_GTUNABLE/ETHTOOL_PHY_STUNABLE and PHY downshift") > Signed-off-by: Michal Kubecek LGTM -- queued for next release... -- John W. Linville Someday the world will need a hero, and you linville@tuxdriver.com might be all we have. Be ready.