提交 716af4ab 编写于 作者: D Dan Carpenter 提交者: David S. Miller

ksz884x: don't copy too much in netdev_set_mac_address()

MAX_ADDR_LEN is 32.  ETH_ALEN is 6.  mac->sa_data is a 14 byte array, so
the memcpy() is doing a read past the end of the array.  I asked about
this on netdev and Ben Hutchings told me it's supposed to be copying
ETH_ALEN bytes (thanks Ben).
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 22b4a4f2
...@@ -5675,7 +5675,7 @@ static int netdev_set_mac_address(struct net_device *dev, void *addr) ...@@ -5675,7 +5675,7 @@ static int netdev_set_mac_address(struct net_device *dev, void *addr)
memcpy(hw->override_addr, mac->sa_data, ETH_ALEN); memcpy(hw->override_addr, mac->sa_data, ETH_ALEN);
} }
memcpy(dev->dev_addr, mac->sa_data, MAX_ADDR_LEN); memcpy(dev->dev_addr, mac->sa_data, ETH_ALEN);
interrupt = hw_block_intr(hw); interrupt = hw_block_intr(hw);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册