| Message ID | 20100303070724.GC5086@bicker |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Dan Carpenter <error27@gmail.com> Date: Wed, 3 Mar 2010 10:07:24 +0300 > This off by one error was found by smatch. > > drivers/net/davinci_emac.c +2390 emac_dev_open(13) error: buffer overflow 'priv->mac_addr' 6 <= 6 > > Signed-off-by: Dan Carpenter <error27@gmail.com> > --- > I don't have the hardware to test this. If would be cool if someone > would verify that the hardware still works after the patch is applied. It looks obvious enough for me, taking in more than 6 address bytes make no sense in an ethernet driver, so I'll apply this. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c index 1605bc2..eab07cd 100644 --- a/drivers/net/davinci_emac.c +++ b/drivers/net/davinci_emac.c @@ -2386,7 +2386,7 @@ static int emac_dev_open(struct net_device *ndev) struct emac_priv *priv = netdev_priv(ndev); netif_carrier_off(ndev); - for (cnt = 0; cnt <= ETH_ALEN; cnt++) + for (cnt = 0; cnt < ETH_ALEN; cnt++) ndev->dev_addr[cnt] = priv->mac_addr[cnt]; /* Configuration items */
This off by one error was found by smatch. drivers/net/davinci_emac.c +2390 emac_dev_open(13) error: buffer overflow 'priv->mac_addr' 6 <= 6 Signed-off-by: Dan Carpenter <error27@gmail.com> --- I don't have the hardware to test this. If would be cool if someone would verify that the hardware still works after the patch is applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html