1 files changed, 115 insertions, 34 deletions

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index a0f4964033d2..7a85367b3c2f 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -144,31 +144,13 @@ u32 ethtool_op_get_flags(struct net_device *dev)
 }
 EXPORT_SYMBOL(ethtool_op_get_flags);
 
-int ethtool_op_set_flags(struct net_device *dev, u32 data)
+int ethtool_op_set_flags(struct net_device *dev, u32 data, u32 supported)
 {
-        const struct ethtool_ops *ops = dev->ethtool_ops;
-        unsigned long features = dev->features;
-
-        if (data & ETH_FLAG_LRO)
-                features |= NETIF_F_LRO;
-        else
-                features &= ~NETIF_F_LRO;
-
-        if (data & ETH_FLAG_NTUPLE) {
-                if (!ops->set_rx_ntuple)
-                        return -EOPNOTSUPP;
-                features |= NETIF_F_NTUPLE;
-        } else {
-                /* safe to clear regardless */
-                features &= ~NETIF_F_NTUPLE;
-        }
-
-        if (data & ETH_FLAG_RXHASH)
-                features |= NETIF_F_RXHASH;
-        else
-                features &= ~NETIF_F_RXHASH;
+        if (data & ~supported)
+                return -EINVAL;
 
-        dev->features = features;
+        dev->features = ((dev->features & ~flags_dup_features) |
+                         (data & flags_dup_features));
         return 0;
 }
 EXPORT_SYMBOL(ethtool_op_set_flags);
@@ -318,23 +300,33 @@ out:
 }
 
 static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev,
-                                                void __user *useraddr)
+                                                u32 cmd, void __user *useraddr)
 {
-        struct ethtool_rxnfc cmd;
+        struct ethtool_rxnfc info;
+        size_t info_size = sizeof(info);
 
         if (!dev->ethtool_ops->set_rxnfc)
                 return -EOPNOTSUPP;
 
-        if (copy_from_user(&cmd, useraddr, sizeof(cmd)))
+        /* struct ethtool_rxnfc was originally defined for
+         * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
+         * members.  User-space might still be using that
+         * definition. */
+        if (cmd == ETHTOOL_SRXFH)
+                info_size = (offsetof(struct ethtool_rxnfc, data) +
+                             sizeof(info.data));
+
+        if (copy_from_user(&info, useraddr, info_size))
                 return -EFAULT;
 
-        return dev->ethtool_ops->set_rxnfc(dev, &cmd);
+        return dev->ethtool_ops->set_rxnfc(dev, &info);
 }
 
 static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
-                                                void __user *useraddr)
+                                                u32 cmd, void __user *useraddr)
 {
         struct ethtool_rxnfc info;
+        size_t info_size = sizeof(info);
         const struct ethtool_ops *ops = dev->ethtool_ops;
         int ret;
         void *rule_buf = NULL;
@@ -342,13 +334,22 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
         if (!ops->get_rxnfc)
                 return -EOPNOTSUPP;
 
-        if (copy_from_user(&info, useraddr, sizeof(info)))
+        /* struct ethtool_rxnfc was originally defined for
+         * ETHTOOL_{G,S}RXFH with only the cmd, flow_type and data
+         * members.  User-space might still be using that
+         * definition. */
+        if (cmd == ETHTOOL_GRXFH)
+                info_size = (offsetof(struct ethtool_rxnfc, data) +
+                             sizeof(info.data));
+
+        if (copy_from_user(&info, useraddr, info_size))
                 return -EFAULT;
 
         if (info.cmd == ETHTOOL_GRXCLSRLALL) {
                 if (info.rule_cnt > 0) {
-                        rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
-                                           GFP_USER);
+                        if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
+                                rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+                                                   GFP_USER);
                         if (!rule_buf)
                                 return -ENOMEM;
                 }
@@ -359,7 +360,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
                 goto err_out;
 
         ret = -EFAULT;
-        if (copy_to_user(useraddr, &info, sizeof(info)))
+        if (copy_to_user(useraddr, &info, info_size))
                 goto err_out;
 
         if (rule_buf) {
@@ -376,6 +377,80 @@ err_out:
         return ret;
 }
 
+static noinline_for_stack int ethtool_get_rxfh_indir(struct net_device *dev,
+                                                     void __user *useraddr)
+{
+        struct ethtool_rxfh_indir *indir;
+        u32 table_size;
+        size_t full_size;
+        int ret;
+
+        if (!dev->ethtool_ops->get_rxfh_indir)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&table_size,
+                           useraddr + offsetof(struct ethtool_rxfh_indir, size),
+                           sizeof(table_size)))
+                return -EFAULT;
+
+        if (table_size >
+            (KMALLOC_MAX_SIZE - sizeof(*indir)) / sizeof(*indir->ring_index))
+                return -ENOMEM;
+        full_size = sizeof(*indir) + sizeof(*indir->ring_index) * table_size;
+        indir = kmalloc(full_size, GFP_USER);
+        if (!indir)
+                return -ENOMEM;
+
+        indir->cmd = ETHTOOL_GRXFHINDIR;
+        indir->size = table_size;
+        ret = dev->ethtool_ops->get_rxfh_indir(dev, indir);
+        if (ret)
+                goto out;
+
+        if (copy_to_user(useraddr, indir, full_size))
+                ret = -EFAULT;
+
+out:
+        kfree(indir);
+        return ret;
+}
+
+static noinline_for_stack int ethtool_set_rxfh_indir(struct net_device *dev,
+                                                     void __user *useraddr)
+{
+        struct ethtool_rxfh_indir *indir;
+        u32 table_size;
+        size_t full_size;
+        int ret;
+
+        if (!dev->ethtool_ops->set_rxfh_indir)
+                return -EOPNOTSUPP;
+
+        if (copy_from_user(&table_size,
+                           useraddr + offsetof(struct ethtool_rxfh_indir, size),
+                           sizeof(table_size)))
+                return -EFAULT;
+
+        if (table_size >
+            (KMALLOC_MAX_SIZE - sizeof(*indir)) / sizeof(*indir->ring_index))
+                return -ENOMEM;
+        full_size = sizeof(*indir) + sizeof(*indir->ring_index) * table_size;
+        indir = kmalloc(full_size, GFP_USER);
+        if (!indir)
+                return -ENOMEM;
+
+        if (copy_from_user(indir, useraddr, full_size)) {
+                ret = -EFAULT;
+                goto out;
+        }
+
+        ret = dev->ethtool_ops->set_rxfh_indir(dev, indir);
+
+out:
+        kfree(indir);
+        return ret;
+}
+
 static void __rx_ntuple_filter_add(struct ethtool_rx_ntuple_list *list,
                         struct ethtool_rx_ntuple_flow_spec *spec,
                         struct ethtool_rx_ntuple_flow_spec_container *fsc)
@@ -1516,12 +1591,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GRXCLSRLCNT:
         case ETHTOOL_GRXCLSRULE:
         case ETHTOOL_GRXCLSRLALL:
-                rc = ethtool_get_rxnfc(dev, useraddr);
+                rc = ethtool_get_rxnfc(dev, ethcmd, useraddr);
                 break;
         case ETHTOOL_SRXFH:
         case ETHTOOL_SRXCLSRLDEL:
         case ETHTOOL_SRXCLSRLINS:
-                rc = ethtool_set_rxnfc(dev, useraddr);
+                rc = ethtool_set_rxnfc(dev, ethcmd, useraddr);
                 break;
         case ETHTOOL_GGRO:
                 rc = ethtool_get_gro(dev, useraddr);
@@ -1544,6 +1619,12 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GSSET_INFO:
                 rc = ethtool_get_sset_info(dev, useraddr);
                 break;
+        case ETHTOOL_GRXFHINDIR:
+                rc = ethtool_get_rxfh_indir(dev, useraddr);
+                break;
+        case ETHTOOL_SRXFHINDIR:
+                rc = ethtool_set_rxfh_indir(dev, useraddr);
+                break;
         default:
                 rc = -EOPNOTSUPP;
         }