From: David Miller <davem@davemloft.net>
To: wang6495@umn.edu
Cc: kjlu@umn.edu, f.fainelli@gmail.com, andrew@lunn.ch,
ecree@solarflare.com, rmk+kernel@armlinux.org.uk,
alan.brady@intel.com, stephen@networkplumber.org,
eugenia@mellanox.com, inbark@mellanox.com,
vidya.chowdary@gmail.com, ynorov@caviumnetworks.com,
viro@zeniv.linux.org.uk, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2] ethtool: fix a potential missing-check bug
Date: Tue, 01 May 2018 14:19:30 -0400 (EDT) [thread overview]
Message-ID: <20180501.141930.969764198768375676.davem@davemloft.net> (raw)
In-Reply-To: <1525109474-5595-1-git-send-email-wang6495@umn.edu>
From: Wenwen Wang <wang6495@umn.edu>
Date: Mon, 30 Apr 2018 12:31:13 -0500
> In ethtool_get_rxnfc(), the object "info" is firstly copied from
> user-space. If the FLOW_RSS flag is set in the member field flow_type of
> "info" (and cmd is ETHTOOL_GRXFH), info needs to be copied again from
> user-space because FLOW_RSS is newer and has new definition, as mentioned
> in the comment. However, given that the user data resides in user-space, a
> malicious user can race to change the data after the first copy. By doing
> so, the user can inject inconsistent data. For example, in the second
> copy, the FLOW_RSS flag could be cleared in the field flow_type of "info".
> In the following execution, "info" will be used in the function
> ops->get_rxnfc(). Such inconsistent data can potentially lead to unexpected
> information leakage since ops->get_rxnfc() will prepare various types of
> data according to flow_type, and the prepared data will be eventually
> copied to user-space. This inconsistent data may also cause undefined
> behaviors based on how ops->get_rxnfc() is implemented.
>
> This patch simply re-verifies the flow_type field of "info" after the
> second copy. If the value is not as expected, an error code will be
> returned.
>
> Signed-off-by: Wenwen Wang <wang6495@umn.edu>
Applied, thanks.
prev parent reply other threads:[~2018-05-01 18:19 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-30 17:31 [PATCH v2] ethtool: fix a potential missing-check bug Wenwen Wang
2018-05-01 18:19 ` David Miller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180501.141930.969764198768375676.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=alan.brady@intel.com \
--cc=andrew@lunn.ch \
--cc=ecree@solarflare.com \
--cc=eugenia@mellanox.com \
--cc=f.fainelli@gmail.com \
--cc=inbark@mellanox.com \
--cc=kjlu@umn.edu \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=rmk+kernel@armlinux.org.uk \
--cc=stephen@networkplumber.org \
--cc=vidya.chowdary@gmail.com \
--cc=viro@zeniv.linux.org.uk \
--cc=wang6495@umn.edu \
--cc=ynorov@caviumnetworks.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).