* [patch 3/3 -mainline] liquidio: off by one in liquidio_set_mcast_list()
@ 2016-06-18 8:50 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2016-06-18 8:50 UTC (permalink / raw)
To: Derek Chickles
Cc: Satanand Burla, Felix Manlunas, Raghu Vatsavayi, netdev,
kernel-janitors
The nctrl.udd[] array has 32 elements of size u64.
Imagine that netdev_mc_count() returns more than 32. That means
"mc_count" is 32. On the last iteration through the loop we have
mc == &nctrl.udd[32] so we're writing one element beyond the end
of the array.
Fixes: f21fb3ed364b ('Add support of Cavium Liquidio ethernet adapters')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c
index 1126422..41ee8bd 100644
--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c
+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c
@@ -2376,7 +2376,7 @@ static void liquidio_set_mcast_list(struct net_device *netdev)
memcpy(((u8 *)mc) + 2, ha->addr, ETH_ALEN);
/* no need to swap bytes */
- if (++mc > &nctrl.udd[mc_count])
+ if (++mc >= &nctrl.udd[mc_count])
break;
}
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2016-06-18 8:50 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-06-18 8:50 [patch 3/3 -mainline] liquidio: off by one in liquidio_set_mcast_list() Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).