ethtool: Ensure new ring parameters are within bounds during SRINGPARAM

BugLink: https://bugs.launchpad.net/bugs/1874444
Add a sanity check to ensure that all requested ring parameters
are within bounds, which should reduce errors in driver implementation.

Signed-off-by: Eugenia Emantayev <eugenia@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 37e2d99b59c4765112533a1d38174fea58d28a51)
Signed-off-by: Guilherme G. Piccoli <gpiccoli@canonical.com>
Acked-by: Kleber Souza <kleber.souza@canonical.com>
Acked-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 3702a24a8cf5aded6be140164d3d0aa3aed2b5ce..86b4f474b46e73d0c235693630e4c1b5b6cc8757 100644 (file)
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1705,14 +1705,23 @@ static int ethtool_get_ringparam(struct net_device *dev, void __user *useraddr)
 
 static int ethtool_set_ringparam(struct net_device *dev, void __user *useraddr)
 {
-       struct ethtool_ringparam ringparam;
+       struct ethtool_ringparam ringparam, max = { .cmd = ETHTOOL_GRINGPARAM };
 
-       if (!dev->ethtool_ops->set_ringparam)
+       if (!dev->ethtool_ops->set_ringparam || !dev->ethtool_ops->get_ringparam)
                return -EOPNOTSUPP;
 
        if (copy_from_user(&ringparam, useraddr, sizeof(ringparam)))
                return -EFAULT;
 
+       dev->ethtool_ops->get_ringparam(dev, &max);
+
+       /* ensure new ring parameters are within the maximums */
+       if (ringparam.rx_pending > max.rx_max_pending ||
+           ringparam.rx_mini_pending > max.rx_mini_max_pending ||
+           ringparam.rx_jumbo_pending > max.rx_jumbo_max_pending ||
+           ringparam.tx_pending > max.tx_max_pending)
+               return -EINVAL;
+
        return dev->ethtool_ops->set_ringparam(dev, &ringparam);
 }