Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net: netxen: correct sysfs bin attribute return code

If read() syscall requests unexpected number of bytes from "dimm" binary
attribute file, return EINVAL instead of EPERM.

At the same time pin down sysfs file size to the fixed
sizeof(struct netxen_dimm_cfg), which allows to exploit some missing
sanity checks from kernfs (file boundary checks vs offset etc.)

Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Vladimir Zapolskiy and committed by
David S. Miller
748a7295 082739aa

+3 -3
+3 -3
drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
··· 3025 3025 u8 dw, rows, cols, banks, ranks; 3026 3026 u32 val; 3027 3027 3028 - if (size != sizeof(struct netxen_dimm_cfg)) { 3028 + if (size < attr->size) { 3029 3029 netdev_err(netdev, "Invalid size\n"); 3030 - return -1; 3030 + return -EINVAL; 3031 3031 } 3032 3032 3033 3033 memset(&dimm, 0, sizeof(struct netxen_dimm_cfg)); ··· 3137 3137 3138 3138 static struct bin_attribute bin_attr_dimm = { 3139 3139 .attr = { .name = "dimm", .mode = (S_IRUGO | S_IWUSR) }, 3140 - .size = 0, 3140 + .size = sizeof(struct netxen_dimm_cfg), 3141 3141 .read = netxen_sysfs_read_dimm, 3142 3142 }; 3143 3143