From patchwork Fri Jul 23 16:36:15 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kulikov Vasiliy X-Patchwork-Id: 59818 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id CF39F1007D1 for ; Sat, 24 Jul 2010 02:36:36 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754368Ab0GWQgc (ORCPT ); Fri, 23 Jul 2010 12:36:32 -0400 Received: from mail-ew0-f46.google.com ([209.85.215.46]:47216 "EHLO mail-ew0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753395Ab0GWQgb (ORCPT ); Fri, 23 Jul 2010 12:36:31 -0400 Received: by ewy23 with SMTP id 23so175532ewy.19 for ; Fri, 23 Jul 2010 09:36:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:cc:subject:date :message-id:x-mailer; bh=ZSjXfZTcSlrNkU460iiRv96BZve++dORDdi2+lqZRsI=; b=KhRI/DohP6QuhoqBFwvpiKv2lXhni9wJ+2YThsbuDxCMuaKGTUcefrdwbkU/ajrxKr EJhwh/44tr1INZwpsHjEL1E2ZXNYVLTOYH299AltDt5Dud7LHVoU7bMGeGDkrZQA/qY/ 38qiFY5hgwqAWJDfjli57ZV1NN4VLOXp1wpRM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:subject:date:message-id:x-mailer; b=QZnxfoCrWVKF9RggNH3tDw6RODwPv2g3oAVq34RwElwxrckxYA5LU16Pzkek11zm8f nF4Pd9/kO9pWORQbQqX/OCn+L/S2JFemHKMXMcMr1u/K1HhMW8lM9So0Rx/jxG7qyZrk U4eJ1uHFMktn1i9NhhbY0Bso4aDrDQZSv+D/c= Received: by 10.213.10.138 with SMTP id p10mr751026ebp.86.1279902989725; Fri, 23 Jul 2010 09:36:29 -0700 (PDT) Received: from localhost ([213.87.80.247]) by mx.google.com with ESMTPS id v59sm637130eeh.22.2010.07.23.09.36.26 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 23 Jul 2010 09:36:28 -0700 (PDT) From: Kulikov Vasiliy To: kernel-janitors@vger.kernel.org Cc: Ramkrishna Vepa , Sivakumar Subramani , Sreenivasa Honnur , Jon Mason , "David S. Miller" , Joe Perches , Jiri Pirko , netdev@vger.kernel.org Subject: [PATCH] net: s2io: fix buffer overflow Date: Fri, 23 Jul 2010 20:36:15 +0400 Message-Id: <1279902976-27146-1-git-send-email-segooon@gmail.com> X-Mailer: git-send-email 1.7.0.4 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org vpd_data[] is allocated as kmalloc(256, GFP_KERNEL), so if cnt = 255 then (cnt + 3) overflows 256. memset() is executed without checking. vpd_data[cnt+2] must be less than 256-cnt-2 as the latter is number of vpd_data[] elements to copy. Do not fill with zero the beginning of nic->serial_num as it will be filled with vpd_data[]. String in product_name[] should be terminated by '\0'. Signed-off-by: Kulikov Vasiliy --- drivers/net/s2io.c | 28 ++++++++++++++++++---------- 1 files changed, 18 insertions(+), 10 deletions(-) diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c index b8b8584..18bc5b7 100644 --- a/drivers/net/s2io.c +++ b/drivers/net/s2io.c @@ -5796,7 +5796,7 @@ static void s2io_vpd_read(struct s2io_nic *nic) { u8 *vpd_data; u8 data; - int i = 0, cnt, fail = 0; + int i = 0, cnt, len, fail = 0; int vpd_addr = 0x80; struct swStat *swstats = &nic->mac_control.stats_info->sw_stat; @@ -5837,20 +5837,28 @@ static void s2io_vpd_read(struct s2io_nic *nic) if (!fail) { /* read serial number of adapter */ - for (cnt = 0; cnt < 256; cnt++) { + for (cnt = 0; cnt < 252; cnt++) { if ((vpd_data[cnt] == 'S') && - (vpd_data[cnt+1] == 'N') && - (vpd_data[cnt+2] < VPD_STRING_LEN)) { - memset(nic->serial_num, 0, VPD_STRING_LEN); - memcpy(nic->serial_num, &vpd_data[cnt + 3], - vpd_data[cnt+2]); - break; + (vpd_data[cnt+1] == 'N')) { + len = vpd_data[cnt+2]; + if (len < min(VPD_STRING_LEN, 256-cnt-2)) { + memcpy(nic->serial_num, + &vpd_data[cnt + 3], + len); + memset(nic->serial_num+len, + 0, + VPD_STRING_LEN-len); + break; + } } } } - if ((!fail) && (vpd_data[1] < VPD_STRING_LEN)) - memcpy(nic->product_name, &vpd_data[3], vpd_data[1]); + if ((!fail) && (vpd_data[1] < VPD_STRING_LEN)) { + len = vpd_data[1]; + memcpy(nic->product_name, &vpd_data[3], len); + nic->product_name[len] = 0; + } kfree(vpd_data); swstats->mem_freed += 256; }