Searched hist:"0 b86a2a1" (Results 1 – 1 of 1) sorted by relevance
/openbmc/linux/drivers/net/ethernet/chelsio/cxgb3/ |
H A D | cxgb3_main.c | 0b86a2a1 Fri Apr 29 04:06:50 CDT 2016 Michal Schmidt <mschmidt@redhat.com> cxgb3: fix out of bounds read
An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN.
t3_config_rss() expects both arrays it gets as parameters to have terminators. setup_rss(), the caller, forgets to add a terminator to one of the arrays. Thankfully the iteration in t3_config_rss() stops anyway, but in the last iteration the check for the terminator is an out of bounds read.
Add the missing terminator to rspq_map[].
Reported-by: Jan Stancek <jstancek@redhat.com> Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> 0b86a2a1 Fri Apr 29 04:06:50 CDT 2016 Michal Schmidt <mschmidt@redhat.com> cxgb3: fix out of bounds read An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN. t3_config_rss() expects both arrays it gets as parameters to have terminators. setup_rss(), the caller, forgets to add a terminator to one of the arrays. Thankfully the iteration in t3_config_rss() stops anyway, but in the last iteration the check for the terminator is an out of bounds read. Add the missing terminator to rspq_map[]. Reported-by: Jan Stancek <jstancek@redhat.com> Signed-off-by: Michal Schmidt <mschmidt@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
|