lkml.org 
[lkml]   [2020]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 257/312] sfc: fix potential stack corruption from running past stat bitmask
    Date
    From: Andrew Rybchenko <Andrew.Rybchenko@oktetlabs.ru>

    commit e70c70c38d7a5ced76fc8b1c4a7ccee76e9c2911 upstream.

    On 32-bit systems, mask is only an array of 3 longs, not 4, so don't try
    to write to mask[3].
    Also include build-time checks in case the size of the bitmask changes.

    Fixes: 3c36a2aded8c ("sfc: display vadaptor statistics for all interfaces")
    Signed-off-by: Edward Cree <ecree@solarflare.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/ethernet/sfc/ef10.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/net/ethernet/sfc/ef10.c
    +++ b/drivers/net/ethernet/sfc/ef10.c
    @@ -1304,13 +1304,14 @@ static void efx_ef10_get_stat_mask(struc
    }

    #if BITS_PER_LONG == 64
    + BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 2);
    mask[0] = raw_mask[0];
    mask[1] = raw_mask[1];
    #else
    + BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 3);
    mask[0] = raw_mask[0] & 0xffffffff;
    mask[1] = raw_mask[0] >> 32;
    mask[2] = raw_mask[1] & 0xffffffff;
    - mask[3] = raw_mask[1] >> 32;
    #endif
    }


    \
     
     \ /
      Last update: 2020-05-08 14:48    [W:4.639 / U:0.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site