net: phy: marvell: Fix buffer overrun with stats counters [Linux 5.1]

net: phy: marvell: Fix buffer overrun with stats counters [Linux 5.1]

This Linux kernel change "net: phy: marvell: Fix buffer overrun with stats counters" is included in the Linux 5.1 release. This change is authored by Andrew Lunn <andrew [at] lunn.ch> on Thu Apr 25 00:33:00 2019 +0200. The commit for this change in Linux stable tree is fdfdf86 (patch).

net: phy: marvell: Fix buffer overrun with stats counters

marvell_get_sset_count() returns how many statistics counters there
are. If the PHY supports fibre, there are 3, otherwise two.

marvell_get_strings() does not make this distinction, and always
returns 3 strings. This then often results in writing past the end
of the buffer for the strings.

Fixes: 2170fef78a40 ("Marvell phy: add field to get errors from fiber link.")
Signed-off-by: Andrew Lunn <[email protected]>
Reviewed-by: Florian Fainelli <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

There are 6 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/net/phy/marvell.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 3ccba37..f76c404 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1489,9 +1489,10 @@ static int marvell_get_sset_count(struct phy_device *phydev)

 static void marvell_get_strings(struct phy_device *phydev, u8 *data)
 {
+   int count = marvell_get_sset_count(phydev);
    int i;

-   for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++) {
+   for (i = 0; i < count; i++) {
        strlcpy(data + i * ETH_GSTRING_LEN,
            marvell_hw_stats[i].string, ETH_GSTRING_LEN);
    }
@@ -1519,9 +1520,10 @@ static u64 marvell_get_stat(struct phy_device *phydev, int i)
 static void marvell_get_stats(struct phy_device *phydev,
                  struct ethtool_stats *stats, u64 *data)
 {
+   int count = marvell_get_sset_count(phydev);
    int i;

-   for (i = 0; i < ARRAY_SIZE(marvell_hw_stats); i++)
+   for (i = 0; i < count; i++)
        data[i] = marvell_get_stat(phydev, i);
 }

Leave a Reply

Your email address will not be published. Required fields are marked *