From: Joe Perches <joe@perches.com>
To: Steve Glendinning <steve.glendinning@shawell.net>
Cc: netdev@vger.kernel.org, Bjorn Mork <bjorn@mork.no>
Subject: Re: [PATCH 1/5] smsc95xx: fix suspend buffer overflow
Date: Fri, 30 Nov 2012 08:03:41 -0800 [thread overview]
Message-ID: <1354291421.11903.25.camel@joe-AO722> (raw)
In-Reply-To: <1354290952-27109-2-git-send-email-steve.glendinning@shawell.net>
On Fri, 2012-11-30 at 15:55 +0000, Steve Glendinning wrote:
> This patch fixes a buffer overflow introduced by bbd9f9e, where
> the filter_mask array is accessed beyond its bounds.
[]
> diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
[]
> @@ -1281,7 +1281,7 @@ static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message)
> }
>
> if (pdata->wolopts & (WAKE_BCAST | WAKE_MCAST | WAKE_ARP | WAKE_UCAST)) {
> - u32 *filter_mask = kzalloc(32, GFP_KERNEL);
> + u32 *filter_mask = kzalloc(sizeof(u32) * 32, GFP_KERNEL);
Just get rid of the alloc and use 32 u8's on stack.
It's small enough
No filter value is > FF and the compiler with expand
the u8 to u32 when writing to the card.
next prev parent reply other threads:[~2012-11-30 16:03 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-30 15:55 [PATCH 0/5] smsc95xx enhancements Steve Glendinning
2012-11-30 15:55 ` [PATCH 1/5] smsc95xx: fix suspend buffer overflow Steve Glendinning
2012-11-30 16:03 ` Joe Perches [this message]
2012-11-30 15:55 ` [PATCH 2/5] smsc95xx: fix error handling in suspend failure case Steve Glendinning
2012-11-30 15:55 ` [PATCH 3/5] smsc95xx: don't enable remote wakeup directly Steve Glendinning
2012-11-30 15:55 ` [PATCH 4/5] smsc95xx: fix smsc_crc return type Steve Glendinning
2012-11-30 15:59 ` Joe Perches
2012-11-30 15:55 ` [PATCH 5/5] smsc95xx: expand check_ macros Steve Glendinning
2012-12-03 10:41 ` David Laight
2012-12-10 9:16 ` Steve Glendinning
2012-11-30 17:28 ` [PATCH 0/5] smsc95xx enhancements David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1354291421.11903.25.camel@joe-AO722 \
--to=joe@perches.com \
--cc=bjorn@mork.no \
--cc=netdev@vger.kernel.org \
--cc=steve.glendinning@shawell.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).