All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Tristram.Ha@micrel.com
Cc: netdev@vger.kernel.org
Subject: re: net: Micrel KSZ8841/2 PCI Ethernet driver
Date: Wed, 18 Apr 2012 09:47:23 +0300	[thread overview]
Message-ID: <20120418064723.GA12831@elgon.mountain> (raw)

Hello Tristram,

I was going through some old stuff and I had a question about ksz884x.c.

The patch 8ca86fd83eae: "net: Micrel KSZ8841/2 PCI Ethernet driver" 
from Feb 8, 2010, leads to the following warning:
drivers/net/ethernet/micrel/ksz884x.c:5678 netdev_set_mac_address()
	 error: memcpy() 'mac->sa_data' too small (14 vs 32)

  5663  static int netdev_set_mac_address(struct net_device *dev, void *addr)
  5664  {
  5665          struct dev_priv *priv = netdev_priv(dev);
  5666          struct dev_info *hw_priv = priv->adapter;
  5667          struct ksz_hw *hw = &hw_priv->hw;
  5668          struct sockaddr *mac = addr;
  5669          uint interrupt;
  5670  
  5671          if (priv->port.first_port > 0)
  5672                  hw_del_addr(hw, dev->dev_addr);
  5673          else {
  5674                  hw->mac_override = 1;
  5675                  memcpy(hw->override_addr, mac->sa_data, ETH_ALEN);
  5676          }
  5677  
  5678          memcpy(dev->dev_addr, mac->sa_data, MAX_ADDR_LEN);
                                      ^^^^^^^^^^^^
This has only 14 bytes so we're copying bogus data from beyond the end
of the struct into dev->dev_addr.

  5679  

regards,
dan carpenter

             reply	other threads:[~2012-04-18  6:47 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-04-18  6:47 Dan Carpenter [this message]
2012-04-18 14:13 ` net: Micrel KSZ8841/2 PCI Ethernet driver Ben Hutchings
2012-04-18 14:51   ` Dan Carpenter
2012-04-19  7:00   ` [patch] ksz884x: don't copy too much in netdev_set_mac_address() Dan Carpenter
2012-04-19 17:25     ` David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20120418064723.GA12831@elgon.mountain \
    --to=dan.carpenter@oracle.com \
    --cc=Tristram.Ha@micrel.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.