From patchwork Fri Nov 21 19:01:28 2008 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kirsher, Jeffrey T" X-Patchwork-Id: 10088 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 6CE5CDDDED for ; Sat, 22 Nov 2008 06:01:59 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757422AbYKUTBx (ORCPT ); Fri, 21 Nov 2008 14:01:53 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1757238AbYKUTBx (ORCPT ); Fri, 21 Nov 2008 14:01:53 -0500 Received: from qmta03.emeryville.ca.mail.comcast.net ([76.96.30.32]:37002 "EHLO QMTA03.emeryville.ca.mail.comcast.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757409AbYKUTBw (ORCPT ); Fri, 21 Nov 2008 14:01:52 -0500 Received: from OMTA12.emeryville.ca.mail.comcast.net ([76.96.30.44]) by QMTA03.emeryville.ca.mail.comcast.net with comcast id hqN11a00Q0x6nqcA3v1ru6; Fri, 21 Nov 2008 19:01:51 +0000 Received: from gitlost.lost ([63.64.152.142]) by OMTA12.emeryville.ca.mail.comcast.net with comcast id hv1U1a00R34bfcX8Yv1W2t; Fri, 21 Nov 2008 19:01:43 +0000 X-Authority-Analysis: v=1.0 c=1 a=u9WUhuAIGMUA:10 a=G5QlAPCzRwMA:10 a=sLw7XzSbQy0Hxft38QEA:9 a=Kt3YaZPCY2PrWbYDiTNaHk2mxeIA:4 a=dGJ0OcVc7YAA:10 a=iYlkOlhu7C0A:10 From: Jeff Kirsher Subject: [NET-NEXT PATCH 09/14] e1000e: fix possible buffer overflow To: davem@davemloft.net Cc: netdev@vger.kernel.org, jeff@garzik.org, Bruce Allan , Jeff Kirsher Date: Fri, 21 Nov 2008 11:01:28 -0800 Message-ID: <20081121190128.32313.90707.stgit@gitlost.lost> In-Reply-To: <20081121185859.32313.42332.stgit@gitlost.lost> References: <20081121185859.32313.42332.stgit@gitlost.lost> User-Agent: StGIT/0.14.3 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Bruce Allan Put in missing bounds checking of an array. Signed-off-by: Bruce Allan Signed-off-by: Jeff Kirsher --- drivers/net/e1000e/es2lan.c | 5 +++++ drivers/net/e1000e/phy.c | 5 +++++ 2 files changed, 10 insertions(+), 0 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c index db51114..b5250fd 100644 --- a/drivers/net/e1000e/es2lan.c +++ b/drivers/net/e1000e/es2lan.c @@ -104,6 +104,8 @@ */ static const u16 e1000_gg82563_cable_length_table[] = { 0, 60, 115, 150, 150, 60, 115, 150, 180, 180, 0xFF }; +#define GG82563_CABLE_LENGTH_TABLE_SIZE \ + ARRAY_SIZE(e1000_gg82563_cable_length_table) static s32 e1000_setup_copper_link_80003es2lan(struct e1000_hw *hw); static s32 e1000_acquire_swfw_sync_80003es2lan(struct e1000_hw *hw, u16 mask); @@ -721,6 +723,9 @@ static s32 e1000_get_cable_length_80003es2lan(struct e1000_hw *hw) return ret_val; index = phy_data & GG82563_DSPD_CABLE_LENGTH; + if (index >= GG82563_CABLE_LENGTH_TABLE_SIZE + 5) + return E1000_ERR_PHY; + phy->min_cable_length = e1000_gg82563_cable_length_table[index]; phy->max_cable_length = e1000_gg82563_cable_length_table[index+5]; diff --git a/drivers/net/e1000e/phy.c b/drivers/net/e1000e/phy.c index cb7d71e..d3aa6b7 100644 --- a/drivers/net/e1000e/phy.c +++ b/drivers/net/e1000e/phy.c @@ -41,6 +41,8 @@ static s32 e1000_access_phy_wakeup_reg_bm(struct e1000_hw *hw, u32 offset, /* Cable length tables */ static const u16 e1000_m88_cable_length_table[] = { 0, 50, 80, 110, 140, 140, E1000_CABLE_LENGTH_UNDEFINED }; +#define M88E1000_CABLE_LENGTH_TABLE_SIZE \ + ARRAY_SIZE(e1000_m88_cable_length_table) static const u16 e1000_igp_2_cable_length_table[] = { 0, 0, 0, 0, 0, 0, 0, 0, 3, 5, 8, 11, 13, 16, 18, 21, 0, 0, 0, 3, @@ -1442,6 +1444,9 @@ s32 e1000e_get_cable_length_m88(struct e1000_hw *hw) index = (phy_data & M88E1000_PSSR_CABLE_LENGTH) >> M88E1000_PSSR_CABLE_LENGTH_SHIFT; + if (index >= M88E1000_CABLE_LENGTH_TABLE_SIZE + 1) + return E1000_ERR_PHY; + phy->min_cable_length = e1000_m88_cable_length_table[index]; phy->max_cable_length = e1000_m88_cable_length_table[index+1];