linux/drivers/s390
Julian Wiedmann 292a50e3fc s390/qeth: reject oversized SNMP requests
Commit d4c08afafa ("s390/qeth: streamline SNMP cmd code") removed
the bounds checking for req_len, under the assumption that the check in
qeth_alloc_cmd() would suffice.

But that code path isn't sufficiently robust to handle a user-provided
data_length, which could overflow (when adding the cmd header overhead)
before being checked against QETH_BUFSIZE. We end up allocating just a
tiny iob, and the subsequent copy_from_user() writes past the end of
that iob.

Special-case this path and add a coarse bounds check, to protect against
maliciuous requests. This let's the subsequent code flow do its normal
job and precise checking, without risk of overflow.

Fixes: d4c08afafa ("s390/qeth: streamline SNMP cmd code")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-08-24 16:34:08 -07:00
..
block s390/dasd: fix endless loop after read unit address configuration 2019-08-01 20:46:14 -06:00
char s390/3215: add switch fall through comment for -Wimplicit-fallthrough 2019-07-29 18:05:03 +02:00
cio vfio-ccw: make vfio_ccw_async_region_ops static 2019-07-29 18:05:03 +02:00
crypto s390/zcrypt: adjust switch fall through comments for -Wimplicit-fallthrough 2019-08-02 13:58:23 +02:00
net s390/qeth: reject oversized SNMP requests 2019-08-24 16:34:08 -07:00
scsi SCSI fixes on 20190720 2019-07-20 10:04:58 -07:00
virtio virtio/s390: fix race on airq_areas[] 2019-07-26 13:36:18 +02:00
Makefile