lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <0329de90095bb2eb1ae24c4c3ed2958cb5c125f8.1547878835.git.igor.russkikh@aquantia.com> Date: Mon, 21 Jan 2019 14:53:51 +0000 From: Igor Russkikh <Igor.Russkikh@...antia.com> To: "David S . Miller" <davem@...emloft.net> CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>, Igor Russkikh <Igor.Russkikh@...antia.com>, Nikita Danilov <Nikita.Danilov@...antia.com> Subject: [PATCH net 4/5] net: aquantia: fixed instack structure overflow This is a real stack undercorruption found by kasan build. The issue did no harm normally because it only overflowed 2 bytes after `bitary` array which on most architectures were mapped into `err` local. Signed-off-by: Nikita Danilov <nikita.danilov@...antia.com> Signed-off-by: Igor Russkikh <igor.russkikh@...antia.com> --- drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c index b58ca7cb8e9d..c4cdc51350b2 100644 --- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c @@ -199,8 +199,8 @@ static int hw_atl_b0_hw_rss_set(struct aq_hw_s *self, u32 i = 0U; u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues); int err = 0; - u16 bitary[(HW_ATL_B0_RSS_REDIRECTION_MAX * - HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)]; + u16 bitary[1 + (HW_ATL_B0_RSS_REDIRECTION_MAX * + HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)]; memset(bitary, 0, sizeof(bitary)); -- 2.17.1
Powered by blists - more mailing lists