Messages in this thread | | | From | Linus Walleij <> | Date | Wed, 15 Mar 2023 14:15:13 +0100 | Subject | Re: [PATCH net 1/2] net: dsa: realtek: fix out-of-bounds access |
| |
On Wed, Mar 15, 2023 at 2:09 PM Ahmad Fatoum <a.fatoum@pengutronix.de> wrote:
> The probe function sets priv->chip_data to (void *)priv + sizeof(*priv) > with the expectation that priv has enough trailing space. > > However, only realtek-smi actually allocated this chip_data space. > Do likewise in realtek-mdio to fix out-of-bounds accesses. > > Fixes: aac94001067d ("net: dsa: realtek: add new mdio interface for drivers") > Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
That this worked for so long is kind of scary, and the reason why we run Kasan over so much code, I don't know if Kasan would have found this one.
Rewriting the whole world in Rust will fix this problem, but it will take a while...
Yours, Linus Walleij
| |