Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 73f98eab authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

pch_gbe: memory corruption calling pch_gbe_validate_option() 



pch_gbe_validate_option() modifies 32 bits of memory but we pass
&hw->phy.autoneg_advertised which only has 16 bits and &hw->mac.fc
which only has 8 bits.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1e804aec

drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c

+8 −7
Original line number Diff line number Diff line
@@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter) 
			pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");

			hw->phy.autoneg_advertised = opt.def;

		} else {

			hw->phy.autoneg_advertised = AutoNeg;

			pch_gbe_validate_option(

				(int *)(&hw->phy.autoneg_advertised),

				&opt, adapter);

			int tmp = AutoNeg;



			pch_gbe_validate_option(&tmp, &opt, adapter);

			hw->phy.autoneg_advertised = tmp;

		}

	}
@@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter) 
			.arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),

					 .p = fc_list } }

		};

		hw->mac.fc = FlowControl;

		pch_gbe_validate_option((int *)(&hw->mac.fc),

						&opt, adapter);

		int tmp = FlowControl;



		pch_gbe_validate_option(&tmp, &opt, adapter);

		hw->mac.fc = tmp;

	}



	pch_gbe_check_copper_options(adapter);