net: dsa: fix a crash if ->get_sset_count() fails
stable inclusion from stable-v4.19.193 commit 0f2cb08c57edefb0e7b5045e0e3e9980a3d3aa37 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BHSG CVE: CVE-2021-47159 -------------------------------- commit a269333f upstream. If ds->ops->get_sset_count() fails then it "count" is a negative error code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative error code is type promoted to a very high value and the loop will corrupt memory until the system crashes. Fix this by checking for error codes and changing the type of "i" to just int. Fixes: badf3ada ("net: dsa: Provide CPU port statistics to master netdev") Signed-off-by:Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by:
Andrew Lunn <andrew@lunn.ch> Reviewed-by:
Florian Fainelli <f.fainelli@gmail.com> Reviewed-by:
Vladimir Oltean <olteanv@gmail.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Ziyang Xuan <william.xuanziyang@huawei.com>
Loading
Please sign in to comment