ethtool 5.2 qsfp.c heap buffer overflow
From: Qiwei Wen <hidden>
Date: 2019-09-24 07:41:44
From: Qiwei Wen <hidden>
Date: 2019-09-24 07:41:44
Hi, The function "sff8636_dom_parse", called from "sff8636_show_dom", disregards the module eeprom size returned from the driver and assumes the existence of upper pages, e.g. sd->sfp_temp[HALRM] = SFF8636_OFFSET_TO_TEMP(SFF8636_TEMP_HALRM); To reproduce: return ETH_MODULE_SFF_8636_LEN (256) for module eeprom length in NIC driver, compile ethtool 5.2 with clang and address sanitizer linked in, run ethtool -m. Best regards, Dave