lkml.org 
[lkml]   [2000]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patches in this message
/
Date
From
Subject[PATCH] tulip driver, 2.4.0-test11 kernel, media type

Error/bug in the "tulip" network driver from the 2.4.0-test11 kernel, when
detecting media type.

The bug is quite simple. When detecting the media type, it's possible to
access data outside/beyond the array "medianame[]". This leads to an
kernel panic Oops.

I detected the bug, when using the netcard:
Phobos P430 Quad port (4 port card)

The card reports it's media type ("leaf->media") to be "17". And the
array "medianame" only contains 16 entries (0-15).


This patch only assures that we don't access elements beyond the static
size of the array (defensive coding).

We should of course expand the array "medianame" with the appropriate
entries. Note, that Donald Beckers version of the tulip driver have 8
extra elements in this array.

Jesper Brouer <hawk@diku.dk>

-------------------------------------------------------------------
System Administrator
Dept. of Computer Science, University of Copenhagen
E-mail: hawk@diku.dk, Direct Tel.: 353 21375
-------------------------------------------------------------------

The patch:

--- linux-2.4.0-test11/drivers/net/tulip/eeprom.c Mon Jun 19 22:42:39 2000
+++ linux/drivers/net/tulip/eeprom.c Wed Dec 6 23:03:10 2000
@@ -236,7 +236,8 @@
}
printk(KERN_INFO "%s: Index #%d - Media %s (#%d) described "
"by a %s (%d) block.\n",
- dev->name, i, medianame[leaf->media], leaf->media,
+ dev->name, i,
+ leaf->media < 16 ? medianame[leaf->media] : "UNKNOWN", leaf->media,
block_name[leaf->type], leaf->type);
}
if (new_advertise)--- linux-2.4.0-test11/drivers/net/tulip/eeprom.c Mon Jun 19 22:42:39 2000
+++ linux/drivers/net/tulip/eeprom.c Wed Dec 6 23:03:10 2000
@@ -236,7 +236,8 @@
}
printk(KERN_INFO "%s: Index #%d - Media %s (#%d) described "
"by a %s (%d) block.\n",
- dev->name, i, medianame[leaf->media], leaf->media,
+ dev->name, i,
+ leaf->media < 16 ? medianame[leaf->media] : "UNKNOWN", leaf->media,
block_name[leaf->type], leaf->type);
}
if (new_advertise)
\
 
 \ /
  Last update: 2005-03-22 12:51    [W:0.022 / U:0.504 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site