Skip to contentSkip to conversation

net: sysfs: ethtool_ops can be NULL

PATCH Applied Eric Dumazet 3 participants 3 messages Oct 26, 2009 – Oct 28, 2009

Subsystems (2)
Networking Network drivers
lore
Share & tools
lore

Eric Dumazet

author
#0 lore raw

PATCH 1/1 net: sysfs: ethtool_ops can be NULL

commit d519e17e2d01a0ee9abe083019532061b4438065
(net: export device speed and duplex via sysfs)
made the wrong assumption that netdev->ethtool_ops was always set.

This makes possible to crash kernel and let rtnl in locked state.

modprobe dummy
ip link set dummy0 up
(udev runs and crash)

Signed-off-by Eric Dumazet <[email protected]>
---
 net/core/net-sysfs.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)
net/core/net-sysfs.c +6 -2
index 753c420..89de182 100644
@@ -139,7 +139,9 @@ static ssize_t show_speed(struct device *dev,
 	if (!rtnl_trylock())
 		return restart_syscall();
 
-	if (netif_running(netdev) && netdev->ethtool_ops->get_settings) {
+	if (netif_running(netdev) &&
+	    netdev->ethtool_ops &&
+	    netdev->ethtool_ops->get_settings) {
 		struct ethtool_cmd cmd = { ETHTOOL_GSET };
 
 		if (!netdev->ethtool_ops->get_settings(netdev, &cmd))

@@ -158,7 +160,9 @@ static ssize_t show_duplex(struct device *dev,
 	if (!rtnl_trylock())
 		return restart_syscall();
 
-	if (netif_running(netdev) && netdev->ethtool_ops->get_settings) {
+	if (netif_running(netdev) &&
+	    netdev->ethtool_ops &&
+	    netdev->ethtool_ops->get_settings) {
 		struct ethtool_cmd cmd = { ETHTOOL_GSET };
 
 		if (!netdev->ethtool_ops->get_settings(netdev, &cmd))
Acked-by on v1 1/1
#1 lore raw
Quoted 31 lines · Eric Dumazet

commit d519e17e2d01a0ee9abe083019532061b4438065
(net: export device speed and duplex via sysfs)
made the wrong assumption that netdev->ethtool_ops was always set.

This makes possible to crash kernel and let rtnl in locked state.

modprobe dummy
ip link set dummy0 up
(udev runs and crash)

Signed-off-by Eric Dumazet <[email protected]>
---
 net/core/net-sysfs.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)
net/core/net-sysfs.c +3 -1
index 753c420..89de182 100644
@@ -139,7 +139,9 @@ static ssize_t show_speed(struct device *dev,
 	if (!rtnl_trylock())
 		return restart_syscall();
 
-	if (netif_running(netdev) && netdev->ethtool_ops->get_settings) {
+	if (netif_running(netdev) &&
+	    netdev->ethtool_ops &&
+	    netdev->ethtool_ops->get_settings) {
 		struct ethtool_cmd cmd = { ETHTOOL_GSET };
 
 		if (!netdev->ethtool_ops->get_settings(netdev, &cmd))

net/core/net-sysfs.c static ssize_t show_duplex(struct device *dev, · line 168

Quoted 10 lines
net/core/net-sysfs.c +3 -1
@@ -158,7 +160,9 @@ static ssize_t show_duplex(struct device *dev,
 	if (!rtnl_trylock())
 		return restart_syscall();
 
-	if (netif_running(netdev) && netdev->ethtool_ops->get_settings) {
+	if (netif_running(netdev) &&
+	    netdev->ethtool_ops &&
+	    netdev->ethtool_ops->get_settings) {
 		struct ethtool_cmd cmd = { ETHTOOL_GSET };
 
 		if (!netdev->ethtool_ops->get_settings(netdev, &cmd))

Nice catch, Eric.

Acked-by Andy Gospodarek <[email protected]>
maintainer Applied
#2 lore raw

From: Andy Gospodarek <[email protected]>
Date: Mon, 26 Oct 2009 09:40:33 -0400

Quoted 12 lines · Eric Dumazet
Quoted 11 lines

commit d519e17e2d01a0ee9abe083019532061b4438065
(net: export device speed and duplex via sysfs)
made the wrong assumption that netdev->ethtool_ops was always set.

This makes possible to crash kernel and let rtnl in locked state.

modprobe dummy
ip link set dummy0 up
(udev runs and crash)

Signed-off-by Eric Dumazet <[email protected]>

...

Quoted 3 lines

Nice catch, Eric.

Acked-by Andy Gospodarek <[email protected]>

Applied.