| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1445609940-12234-1-git-send-email-clsoto@linux.vnet.ibm.com> Date: Fri, 23 Oct 2015 10:19:00 -0400 From: clsoto@...ux.vnet.ibm.com To: davem@...emloft.net Cc: netdev@...r.kernel.org, ogerlitz@...lanox.com, brking@...ux.vnet.ibm.com, yevgenyp@...lanox.com, Carol L Soto <clsoto@...ux.vnet.ibm.com> Subject: [PATCH] net/mlx4: Memcpy at slave_event should copy sizeof mlx4_eqe From: Carol L Soto <clsoto@...ux.vnet.ibm.com> If the caps.eqe_size is bigger than the struct mlx4_eqe then there is a potential for corrupting data at the master context. We can see the message "Master failed to generate an EQE for slave: X" when the event_eqe array wraps and we can see potential oops at the function mlx4_GEN_EQE. Signed-off-by: Carol L Soto <clsoto@...ux.vnet.ibm.com> --- drivers/net/ethernet/mellanox/mlx4/eq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c index c344884..603d1c3 100644 --- a/drivers/net/ethernet/mellanox/mlx4/eq.c +++ b/drivers/net/ethernet/mellanox/mlx4/eq.c @@ -196,7 +196,7 @@ static void slave_event(struct mlx4_dev *dev, u8 slave, struct mlx4_eqe *eqe) return; } - memcpy(s_eqe, eqe, dev->caps.eqe_size - 1); + memcpy(s_eqe, eqe, sizeof(struct mlx4_eqe) - 1); s_eqe->slave_id = slave; /* ensure all information is written before setting the ownersip bit */ dma_wmb(); -- 1.8.3.1 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists