This is a note to let you know that I've just added the patch titled
net: clear heap allocations for privileged ethtool actions
to the 2.6.27-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
net-clear-heap-allocations-for-privileged-ethtool-actions.patch
and it can be found in the queue-2.6.27 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 60f901d85f51dc73ac0427798e5c534c7320b742 Mon Sep 17 00:00:00 2001
From: Kees Cook <[email protected]>
Date: Mon, 1 Nov 2010 08:19:00 -0700
Subject: net: clear heap allocations for privileged ethtool actions
From: Kees Cook <[email protected]>
[ Upstream commit b00916b189d13a615ff05c9242201135992fcda3 ]
Several other ethtool functions leave heap uncleared (potentially) by
drivers. Some interfaces appear safe (eeprom, etc), in that the sizes
are well controlled. In some situations (e.g. unchecked error conditions),
the heap will remain unchanged in areas before copying back to userspace.
Note that these are less of an issue since these all require CAP_NET_ADMIN.
Cc: [email protected]
Signed-off-by: Kees Cook <[email protected]>
Acked-by: Ben Hutchings <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
net/core/ethtool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -256,7 +256,7 @@ static int ethtool_get_regs(struct net_d
if (regs.len > reglen)
regs.len = reglen;
- regbuf = kmalloc(reglen, GFP_USER);
+ regbuf = kzalloc(reglen, GFP_USER);
if (!regbuf)
return -ENOMEM;
Patches currently in stable-queue which might be from [email protected]
are
queue-2.6.27/net-clear-heap-allocations-for-privileged-ethtool-actions.patch
queue-2.6.27/usb-misc-iowarrior-fix-information-leak-to-userland.patch
_______________________________________________
stable mailing list
[email protected]
http://linux.kernel.org/mailman/listinfo/stable
