Return-Path: From: Sasha Levin To: "linux-kernel@vger.kernel.org" , "stable@vger.kernel.org" CC: Timmy Li , "David S . Miller" , Sasha Levin Subject: [PATCH AUTOSEL for 4.9 141/190] net: hns: fix ethtool_get_strings overflow in hns driver Date: Thu, 8 Mar 2018 04:59:54 +0000 Message-ID: <20180308045810.8041-141-alexander.levin@microsoft.com> References: <20180308045810.8041-1-alexander.levin@microsoft.com> In-Reply-To: <20180308045810.8041-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: From: Timmy Li [ Upstream commit 412b65d15a7f8a93794653968308fc100f2aa87c ] hns_get_sset_count() returns HNS_NET_STATS_CNT and the data space allocated is not enough for ethtool_get_strings(), which will cause random memory corruption. When SLAB and DEBUG_SLAB are both enabled, memory corruptions like the the following can be observed without this patch: [ 43.115200] Slab corruption (Not tainted): Acpi-ParseExt start=3Dffff801= fb0b69030, len=3D80 [ 43.115206] Redzone: 0x9f911029d006462/0x5f78745f31657070. [ 43.115208] Last user: [<5f7272655f746b70>](0x5f7272655f746b70) [ 43.115214] 010: 70 70 65 31 5f 74 78 5f 70 6b 74 00 6b 6b 6b 6b ppe1_t= x_pkt.kkkk [ 43.115217] 030: 70 70 65 31 5f 74 78 5f 70 6b 74 5f 6f 6b 00 6b ppe1_t= x_pkt_ok.k [ 43.115218] Next obj: start=3Dffff801fb0b69098, len=3D80 [ 43.115220] Redzone: 0x706d655f6f666966/0x9f911029d74e35b. [ 43.115229] Last user: [](acpi_os_release_object+0x28/= 0x38) [ 43.115231] 000: 74 79 00 6b 6b 6b 6b 6b 70 70 65 31 5f 74 78 5f ty.kkk= kkppe1_tx_ [ 43.115232] 010: 70 6b 74 5f 65 72 72 5f 63 73 75 6d 5f 66 61 69 pkt_er= r_csum_fai Signed-off-by: Timmy Li Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/n= et/ethernet/hisilicon/hns/hns_dsaf_gmac.c index 1e1eb92998fb..07f87373673e 100644 --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c @@ -672,7 +672,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *dat= a) =20 static int hns_gmac_get_sset_count(int stringset) { - if (stringset =3D=3D ETH_SS_STATS) + if (stringset =3D=3D ETH_SS_STATS || stringset =3D=3D ETH_SS_PRIV_FLAGS) return ARRAY_SIZE(g_gmac_stats_string); =20 return 0; diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/ne= t/ethernet/hisilicon/hns/hns_dsaf_ppe.c index 6ea872287307..4ecb809785f9 100644 --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c @@ -422,7 +422,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb) =20 int hns_ppe_get_sset_count(int stringset) { - if (stringset =3D=3D ETH_SS_STATS) + if (stringset =3D=3D ETH_SS_STATS || stringset =3D=3D ETH_SS_PRIV_FLAGS) return ETH_PPE_STATIC_NUM; return 0; } diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/ne= t/ethernet/hisilicon/hns/hns_dsaf_rcb.c index f0ed80d6ef9c..c176db0243da 100644 --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c @@ -799,7 +799,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *d= ata) */ int hns_rcb_get_ring_sset_count(int stringset) { - if (stringset =3D=3D ETH_SS_STATS) + if (stringset =3D=3D ETH_SS_STATS || stringset =3D=3D ETH_SS_PRIV_FLAGS) return HNS_RING_STATIC_REG_NUM; =20 return 0; diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c b/drivers/= net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c index 8f4f0e8da984..d1c868c800f9 100644 --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_xgmac.c @@ -776,7 +776,7 @@ static void hns_xgmac_get_strings(u32 stringset, u8 *da= ta) */ static int hns_xgmac_get_sset_count(int stringset) { - if (stringset =3D=3D ETH_SS_STATS) + if (stringset =3D=3D ETH_SS_STATS || stringset =3D=3D ETH_SS_PRIV_FLAGS) return ARRAY_SIZE(g_xgmac_stats_string); =20 return 0; --=20 2.14.1