Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0eb5a34c authored by Auke Kok's avatar Auke Kok Committed by Auke Kok
Browse files

e100, e1000, ixgb: Fix an impossible memory overwrite bug 



We keep getting requests from people that think that this might be
an exploitable hole where we would overwrite 4 bytes in the netdev
struct if the pci name would exceed 15 characters. In reality this
will never happen but we fix it anyway.

Signed-off-by: default avatarAuke Kok <auke-jan.h.kok@intel.com>
parent 0abb6eb1

drivers/net/e100.c

+1 −1
Original line number Diff line number Diff line
@@ -2572,7 +2572,7 @@ static int __devinit e100_probe(struct pci_dev *pdev, 
#ifdef CONFIG_NET_POLL_CONTROLLER

	netdev->poll_controller = e100_netpoll;

#endif

	strcpy(netdev->name, pci_name(pdev));

	strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);



	nic = netdev_priv(netdev);

	nic->netdev = netdev;

drivers/net/e1000/e1000_main.c

+1 −1
Original line number Diff line number Diff line
@@ -759,7 +759,7 @@ e1000_probe(struct pci_dev *pdev, 
#ifdef CONFIG_NET_POLL_CONTROLLER

	netdev->poll_controller = e1000_netpoll;

#endif

	strcpy(netdev->name, pci_name(pdev));

	strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);



	netdev->mem_start = mmio_start;

	netdev->mem_end = mmio_start + mmio_len;

drivers/net/ixgb/ixgb_main.c

+1 −1
Original line number Diff line number Diff line
@@ -437,7 +437,7 @@ ixgb_probe(struct pci_dev *pdev, 
	netdev->poll_controller = ixgb_netpoll;

#endif



	strcpy(netdev->name, pci_name(pdev));

	strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);

	netdev->mem_start = mmio_start;

	netdev->mem_end = mmio_start + mmio_len;

	netdev->base_addr = adapter->hw.io_base;