Messages in this thread | | | Subject | Re: [net-next v4 6/8] dpaa_eth: add ethtool statistics | From | Joe Perches <> | Date | Mon, 02 Nov 2015 12:39:48 -0800 |
| |
On Mon, 2015-11-02 at 19:31 +0200, Madalin Bucur wrote: > Add a series of counters to be exported through ethtool: > - add detailed counters for reception errors; > - add detailed counters for QMan enqueue reject events; > - count the number of fragmented skbs received from the stack; > - count all frames received on the Tx confirmation path; > - add congestion group statistics; > - count the number of interrupts for each CPU. [] > diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c [] > +static void dpa_get_strings(struct net_device *net_dev, u32 stringset, u8 *data) > +{ > + unsigned int i, j, num_cpus, size; > + char string_cpu[ETH_GSTRING_LEN]; > + u8 *strings; > + > + strings = data; > + num_cpus = num_online_cpus(); > + size = DPA_STATS_GLOBAL_LEN * ETH_GSTRING_LEN; > + > + for (i = 0; i < DPA_STATS_PERCPU_LEN; i++) { > + for (j = 0; j < num_cpus; j++) { > + snprintf(string_cpu, ETH_GSTRING_LEN, "%s [CPU %d]", > + dpa_stats_percpu[i], j); > + memcpy(strings, string_cpu, ETH_GSTRING_LEN); > + strings += ETH_GSTRING_LEN; > + } > + snprintf(string_cpu, ETH_GSTRING_LEN, "%s [TOTAL]", > + dpa_stats_percpu[i]); > + memcpy(strings, string_cpu, ETH_GSTRING_LEN); > + strings += ETH_GSTRING_LEN; > + } > + memcpy(strings, dpa_stats_global, size); > +}
This leaks uninitialized stack via a memcpy of uninitialized string_cpu bytes into user-space.
Using char string_cpu[ETH_GSTRING_LEN] = {}; or a memset before each snprintf would fix it.
| |