• Julian Wiedmann's avatar
    ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() · 0276af21
    Julian Wiedmann authored
    ethtool_set_coalesce() now uses both the .get_coalesce() and
    .set_coalesce() callbacks. But the check for their availability is
    buggy, so changing the coalesce settings on a device where the driver
    provides only _one_ of the callbacks results in a NULL pointer
    dereference instead of an -EOPNOTSUPP.
    
    Fix the condition so that the availability of both callbacks is
    ensured. This also matches the netlink code.
    
    Note that reproducing this requires some effort - it only affects the
    legacy ioctl path, and needs a specific combination of driver options:
    - have .get_coalesce() and .coalesce_supported but no
     .set_coalesce(), or
    - have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn't
      cause the crash as it first attempts to call ethtool_get_coalesce()
      and bails out on error.
    
    Fixes: f3ccfda1
    
     ("ethtool: extend coalesce setting uAPI with CQE mode")
    Cc: Yufeng Mo <moyufeng@huawei.com>
    Cc: Huazhong Tan <tanhuazhong@huawei.com>
    Cc: Andrew Lunn <andrew@lunn.ch>
    Cc: Heiner Kallweit <hkallweit1@gmail.com>
    Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
    Link: https://lore.kernel.org/r/20211126175543.28000-1-jwi@linux.ibm.com
    
    Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    0276af21
ioctl.c 84.8 KB