From: "John W. Linville" <linville@tuxdriver•com>
To: Michal Kubecek <mkubecek@suse•cz>
Cc: netdev@vger•kernel.org,
Raju Lakkaraju <Raju.Lakkaraju@microsemi•com>,
"Allan W. Nielsen" <allan.nielsen@microsemi•com>
Subject: Re: [PATCH ethtool] ethtool: fix stack clash in do_get_phy_tunable and do_set_phy_tunable
Date: Thu, 31 May 2018 13:51:27 -0400 [thread overview]
Message-ID: <20180531175127.GA27980@tuxdriver.com> (raw)
In-Reply-To: <20180509120146.C7408A0C6F@unicorn.suse.cz>
On Wed, May 09, 2018 at 02:01:46PM +0200, Michal Kubecek wrote:
> Users reported stack clash detected when using --get-phy-tunable on
> ppc64le. Problem is caused by local variable ds of type struct
> ethtool_tunable which has last member "void *data[0]". Accessing data[0]
> (as do_get_phy_tunable() does) or adding requested value at the end (which
> is what kernel ioctl does) writes past allocated space for the variable.
>
> Make ds part of an anonymous structure to make sure there is enough space
> for tunable value and drop the (pointless) access to ds.data[0]. The same
> problem also exists in do_set_phy_tunable().
>
> Fixes: b0fe96dec90f ("Ethtool: Implements ETHTOOL_PHY_GTUNABLE/ETHTOOL_PHY_STUNABLE and PHY downshift")
> Signed-off-by: Michal Kubecek <mkubecek@suse•cz>
LGTM -- queued for next release...
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver•com might be all we have. Be ready.
prev parent reply other threads:[~2018-05-31 18:00 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-09 12:01 [PATCH ethtool] ethtool: fix stack clash in do_get_phy_tunable and do_set_phy_tunable Michal Kubecek
2018-05-31 17:51 ` John W. Linville [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180531175127.GA27980@tuxdriver.com \
--to=linville@tuxdriver$(echo .)com \
--cc=Raju.Lakkaraju@microsemi$(echo .)com \
--cc=allan.nielsen@microsemi$(echo .)com \
--cc=mkubecek@suse$(echo .)cz \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox