lkml.org 
[lkml]   [2017]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 25/72] sfc: dont read beyond unicast address list
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Bert Kenward <bkenward@solarflare.com>


    [ Upstream commit c70d68150f71b84cea6997a53493e17bf18a54db ]

    If we have more than 32 unicast MAC addresses assigned to an interface
    we will read beyond the end of the address table in the driver when
    adding filters. The next 256 entries store multicast addresses, so we
    will end up attempting to insert duplicate filters, which is mostly
    harmless. If we add more than 288 unicast addresses we will then read
    past the multicast address table, which is likely to be more exciting.

    Fixes: 12fb0da45c9a ("sfc: clean fallbacks between promisc/normal in efx_ef10_filter_sync_rx_mode")
    Signed-off-by: Bert Kenward <bkenward@solarflare.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/sfc/ef10.c | 8 +++-----
    1 file changed, 3 insertions(+), 5 deletions(-)

    --- a/drivers/net/ethernet/sfc/ef10.c
    +++ b/drivers/net/ethernet/sfc/ef10.c
    @@ -4399,12 +4399,9 @@ static void efx_ef10_filter_uc_addr_list
    struct efx_ef10_filter_table *table = efx->filter_state;
    struct net_device *net_dev = efx->net_dev;
    struct netdev_hw_addr *uc;
    - int addr_count;
    unsigned int i;

    - addr_count = netdev_uc_count(net_dev);
    table->uc_promisc = !!(net_dev->flags & IFF_PROMISC);
    - table->dev_uc_count = 1 + addr_count;
    ether_addr_copy(table->dev_uc_list[0].addr, net_dev->dev_addr);
    i = 1;
    netdev_for_each_uc_addr(uc, net_dev) {
    @@ -4415,6 +4412,8 @@ static void efx_ef10_filter_uc_addr_list
    ether_addr_copy(table->dev_uc_list[i].addr, uc->addr);
    i++;
    }
    +
    + table->dev_uc_count = i;
    }

    static void efx_ef10_filter_mc_addr_list(struct efx_nic *efx)
    @@ -4422,11 +4421,10 @@ static void efx_ef10_filter_mc_addr_list
    struct efx_ef10_filter_table *table = efx->filter_state;
    struct net_device *net_dev = efx->net_dev;
    struct netdev_hw_addr *mc;
    - unsigned int i, addr_count;
    + unsigned int i;

    table->mc_promisc = !!(net_dev->flags & (IFF_PROMISC | IFF_ALLMULTI));

    - addr_count = netdev_mc_count(net_dev);
    i = 0;
    netdev_for_each_mc_addr(mc, net_dev) {
    if (i >= EFX_EF10_FILTER_DEV_MC_MAX) {

    \
     
     \ /
      Last update: 2017-07-19 12:38    [W:2.899 / U:0.108 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site