UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

pch_gbe: memory corruption calling pch_gbe_validate_option() 

pch_gbe_validate_option() modifies 32 bits of memory but we pass
&hw->phy.autoneg_advertised which only has 16 bits and &hw->mac.fc
which only has 8 bits.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Dan Carpenter 2012-02-29 21:17:08 +00:00 committed by David S. Miller
parent 1e804aecd7
commit 73f98eab9b
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
View File

@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n"); pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
hw->phy.autoneg_advertised = opt.def; hw->phy.autoneg_advertised = opt.def;
} else { } else {
hw->phy.autoneg_advertised = AutoNeg; int tmp = AutoNeg;
pch_gbe_validate_option(
(int *)(&hw->phy.autoneg_advertised), pch_gbe_validate_option(&tmp, &opt, adapter);
&opt, adapter); hw->phy.autoneg_advertised = tmp;
} }
} }
@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
.arg = { .l = { .nr = (int)ARRAY_SIZE(fc_list), .arg = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
.p = fc_list } } .p = fc_list } }
}; };
hw->mac.fc = FlowControl; int tmp = FlowControl;
pch_gbe_validate_option((int *)(&hw->mac.fc),
&opt, adapter); pch_gbe_validate_option(&tmp, &opt, adapter);
hw->mac.fc = tmp;
} }
pch_gbe_check_copper_options(adapter); pch_gbe_check_copper_options(adapter);