eepro100 security fix [was: Re: MII access]

[Andrey Savochkin <saw@saw.sw.com.sg>]

[-- Attachment #1: Type: text/plain, Size: 934 bytes --]

Linus,

Please apply the attached patch.
It fixes a security problem of user-controlled access to the card ports from
a non-privileged ioctl which should have read-only semantics.

Best regards
		Andrey

On Tue, Jun 05, 2001 at 11:07:06AM +0200, Bogdan Costescu wrote:
> On Sun, 3 Jun 2001, Jeff Garzik wrote:
> 
> > Bogdan Costescu wrote:
> > > With clearer mind, I have to make some a correction to one of the previous
> > > messages: the problem of not checking arguments range does not apply to
> > > 3c59x which has in the ioctl function '& 0x1f' for both transceiver number
> > > and register number. However, eepro100 and tulip don't do that. (I'm
> > > checking now with 2.4.3 from Mandrake 8, but I don't think that there were
> > > recent changes in these areas).
> >
> > half right -- tulip does this for the phy id but not the MII register
> > number.  I'll fix that up.  Please bug Andrey about fixing up
> > eepro100...

[-- Attachment #2: mii-access1 --]
[-- Type: text/plain, Size: 489 bytes --]

--- drivers/net/eepro100.c.prev	Sat Jan 27 05:07:13 2001
+++ drivers/net/eepro100.c	Wed Jun  6 22:26:03 2001
@@ -1913,7 +1913,7 @@
 		   timer routine.  2000/05/09 SAW */
 		saved_acpi = pci_set_power_state(sp->pdev, 0);
 		t = del_timer_sync(&sp->timer);
-		data[3] = mdio_read(ioaddr, data[0], data[1]);
+		data[3] = mdio_read(ioaddr, data[0] & 0x1f, data[1] & 0x1f);
 		if (t)
 			add_timer(&sp->timer); /* may be set to the past  --SAW */
 		pci_set_power_state(sp->pdev, saved_acpi);