Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0f2cb08c authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

net: dsa: fix a crash if ->get_sset_count() fails 



commit a269333fa5c0c8e53c92b5a28a6076a28cde3e83 upstream.

If ds->ops->get_sset_count() fails then it "count" is a negative error
code such as -EOPNOTSUPP.  Because "i" is an unsigned int, the negative
error code is type promoted to a very high value and the loop will
corrupt memory until the system crashes.

Fix this by checking for error codes and changing the type of "i" to
just int.

Fixes: badf3ada ("net: dsa: Provide CPU port statistics to master netdev")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Reviewed-by: default avatarVladimir Oltean <olteanv@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ae389812

net/dsa/master.c

+3 −2
Original line number Diff line number Diff line
@@ -87,8 +87,7 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset, 
	struct dsa_switch *ds = cpu_dp->ds;

	int port = cpu_dp->index;

	int len = ETH_GSTRING_LEN;

	int mcount = 0, count;

	unsigned int i;

	int mcount = 0, count, i;

	uint8_t pfx[4];

	uint8_t *ndata;
@@ -118,6 +117,8 @@ static void dsa_master_get_strings(struct net_device *dev, uint32_t stringset, 
		 */

		ds->ops->get_strings(ds, port, stringset, ndata);

		count = ds->ops->get_sset_count(ds, port, stringset);

		if (count < 0)

			return;

		for (i = 0; i < count; i++) {

			memmove(ndata + (i * len + sizeof(pfx)),

				ndata + i * len, len - sizeof(pfx));