netdev - Re: [PATCH net-next 1/2] pcnet32: fix reallocation error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 18 Feb 2014 21:29:00 +0900
From:	Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:	pcnet32@...ntier.com
Cc:	davem@...emloft.net, netdev@...r.kernel.org
Subject: Re: [PATCH net-next 1/2] pcnet32: fix reallocation error

Don Fry wrote:
> pcnet32_realloc_rx_ring() only worked on the first log2 number of
> entries in the receive ring instead of the all the entries.
> Replaced "1 << size" with more descriptive variable.

>  	/* first copy the current receive buffers */
> -	overlap = min(size, lp->rx_ring_size);
> +	overlap = min(entries, lp->rx_ring_size);

>  	/* now allocate any new buffers needed */
> -	for (; new < size; new++) {
> +	for (; new < entries; new++) {

Until this fix, lp->rx_skbuff[size...(1<<size)-1] were not allocated by
netdev_alloc_skb() and lp->rx_ring_dma_addr[size...(1<<size)-1] were not mapped
by pci_map_single(), right?

Since lp->rx_ring_size was set to (1<<size), wasn't there possibility that
something bad happens by accessing lp->rx_skbuff[] and lp->rx_ring_dma_addr[]
up to (1<<size)-1 ? (In other words, don't we want to backport this fix?)
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html