Commit 7281b096 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES 



ethnl_update_profile() walks the ETHTOOL_A_PROFILE_IRQ_MODERATION
nest list with an index 'i' and writes new_profile[i++] without
bounding i. The destination is kmemdup()'d at NET_DIM_PARAMS_NUM_PROFILES
entries (5), but the Netlink nest count is entirely user-controlled.
Netlink policies do not have support for constraining the number
of nested entries (or number of multi-attr entries).

Fixes: f750dfe8 ("ethtool: provide customized dim profile management")
Reviewed-by: default avatarMaxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20260526153533.2779187-2-kuba@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent ce1e3302

net/ethtool/coalesce.c

+6 −0
Original line number Diff line number Diff line
@@ -472,6 +472,12 @@ static int ethnl_update_profile(struct net_device *dev, 


	nla_for_each_nested_type(nest, ETHTOOL_A_PROFILE_IRQ_MODERATION,

				 nests, rem) {

		if (i >= NET_DIM_PARAMS_NUM_PROFILES) {

			NL_SET_BAD_ATTR(extack, nest);

			ret = -E2BIG;

			goto err_out;

		}



		ret = nla_parse_nested(tb, len_irq_moder - 1, nest,

				       coalesce_irq_moderation_policy,

				       extack);