提交 73f98eab 编写于 作者: D Dan Carpenter 提交者: David S. Miller

pch_gbe: memory corruption calling pch_gbe_validate_option()

pch_gbe_validate_option() modifies 32 bits of memory but we pass
&hw->phy.autoneg_advertised which only has 16 bits and &hw->mac.fc
which only has 8 bits.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 1e804aec
......@@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
hw->phy.autoneg_advertised = opt.def;
} else {
hw->phy.autoneg_advertised = AutoNeg;
pch_gbe_validate_option(
(int *)(&hw->phy.autoneg_advertised),
&opt, adapter);
int tmp = AutoNeg;
pch_gbe_validate_option(&tmp, &opt, adapter);
hw->phy.autoneg_advertised = tmp;
}
}
......@@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
.arg = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
.p = fc_list } }
};
hw->mac.fc = FlowControl;
pch_gbe_validate_option((int *)(&hw->mac.fc),
&opt, adapter);
int tmp = FlowControl;
pch_gbe_validate_option(&tmp, &opt, adapter);
hw->mac.fc = tmp;
}
pch_gbe_check_copper_options(adapter);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册