net: ethernet: bcmasp: fix possible OOB write in bcmasp_netfilt_get_all_active()

Browse source

rule_locs is allocated in ethtool_get_rxnfc and the size is determined by
rule_cnt from user space. So rule_cnt needs to be check before using
rule_locs to avoid OOB writing or NULL pointer dereference.

Fixes: c5d511c495 ("net: bcmasp: Add support for wake on net filters")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Hangyu Hua 2023-09-08 14:19:48 +08:00 • committed by David S. Miller

parent fa60b81638

commit 9b90aca97f

3 changed files with 10 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

9

drivers/net/ethernet/broadcom/asp2/bcmasp.c

View file

4

drivers/net/ethernet/broadcom/asp2/bcmasp.h

View file

2

drivers/net/ethernet/broadcom/asp2/bcmasp_ethtool.c

View file