Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 31389b53 authored by Konstantin Khorenko's avatar Konstantin Khorenko Committed by Jeff Kirsher
Browse files

i40e: define proper net_device::neigh_priv_len 



Out of bound read reported by KASan.

i40iw_net_event() reads unconditionally 16 bytes from
neigh->primary_key while the memory allocated for
"neighbour" struct is evaluated in neigh_alloc() as

  tbl->entry_size + dev->neigh_priv_len

where "dev" is a net_device.

But the driver does not setup dev->neigh_priv_len and
we read beyond the neigh entry allocated memory,
so the patch in the next mail fixes this.

Signed-off-by: default avatarKonstantin Khorenko <khorenko@virtuozzo.com>
Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent cd0d465b

drivers/net/ethernet/intel/i40e/i40e_main.c

+3 −0
Original line number Diff line number Diff line
@@ -12339,6 +12339,9 @@ static int i40e_config_netdev(struct i40e_vsi *vsi) 
	ether_addr_copy(netdev->dev_addr, mac_addr);

	ether_addr_copy(netdev->perm_addr, mac_addr);



	/* i40iw_net_event() reads 16 bytes from neigh->primary_key */

	netdev->neigh_priv_len = sizeof(u32) * 4;



	netdev->priv_flags |= IFF_UNICAST_FLT;

	netdev->priv_flags |= IFF_SUPP_NOFCS;

	/* Setup netdev TC information */