linux/net/ethtool
Michal Kubecek e34f1753ee ethtool: limit bitset size
Syzbot reported that ethnl_compact_sanity_checks() can be tricked into
reading past the end of ETHTOOL_A_BITSET_VALUE and ETHTOOL_A_BITSET_MASK
attributes and even the message by passing a value between (u32)(-31)
and (u32)(-1) as ETHTOOL_A_BITSET_SIZE.

The problem is that DIV_ROUND_UP(attr_nbits, 32) is 0 for such values so
that zero length ETHTOOL_A_BITSET_VALUE will pass the length check but
ethnl_bitmap32_not_zero() check would try to access up to 512 MB of
attribute "payload".

Prevent this overflow byt limiting the bitset size. Technically, compact
bitset format would allow bitset sizes up to almost 2^18 (so that the
nest size does not exceed U16_MAX) but bitsets used by ethtool are much
shorter. S16_MAX, the largest value which can be directly used as an
upper limit in policy, should be a reasonable compromise.

Fixes: 10b518d4e6 ("ethtool: netlink bitset handling")
Reported-by: syzbot+7fd4ed5b4234ab1fdccd@syzkaller.appspotmail.com
Reported-by: syzbot+709b7a64d57978247e44@syzkaller.appspotmail.com
Reported-by: syzbot+983cb8fb2d17a7af549d@syzkaller.appspotmail.com
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-02-26 11:27:31 -08:00
..
bitset.c ethtool: limit bitset size 2020-02-26 11:27:31 -08:00
bitset.h ethtool: limit bitset size 2020-02-26 11:27:31 -08:00
common.c ethtool: provide WoL settings with WOL_GET request 2020-01-27 11:31:36 +01:00
common.h ethtool: provide WoL settings with WOL_GET request 2020-01-27 11:31:36 +01:00
debug.c ethtool: add DEBUG_NTF notification 2020-01-27 11:31:36 +01:00
ioctl.c net/core: Replace driver version to be kernel version 2020-01-27 13:47:22 +01:00
linkinfo.c ethtool: add LINKINFO_NTF notification 2019-12-27 16:40:02 -08:00
linkmodes.c ethtool: remove set but not used variable 'lsettings' 2020-01-03 12:22:12 -08:00
linkstate.c ethtool: provide link state with LINKSTATE_GET request 2019-12-27 16:40:02 -08:00
Makefile ethtool: provide WoL settings with WOL_GET request 2020-01-27 11:31:36 +01:00
netlink.c ethtool: add WOL_NTF notification 2020-01-27 11:31:36 +01:00
netlink.h ethtool: set wake-on-lan settings with WOL_SET request 2020-01-27 11:31:36 +01:00
strset.c ethtool: provide WoL settings with WOL_GET request 2020-01-27 11:31:36 +01:00
wol.c ethtool: add WOL_NTF notification 2020-01-27 11:31:36 +01:00