xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

s2io: rx_ring_sz bounds checking

Browse Source 
modparm rx_ring_sz can be set to be greater than the maximum allowable
number of blocks.  This results in an array overrun when probing the
driver, and causes memory corruption.

Also, the MAX_RX_DESC_1 multiply the max number of rings by max number
of blocker per ring by 127, but the driver does the same calculation
with 127+1.  This results in the possibility of the value being set
being larger than the maximum allowable value.

Finally, clean-up the s2io_ethtool_gringparam code to be more
intuitive.

Signed-off-by: Jon Mason <jon.mason@exar.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Jon Mason
2010-12-10 15:40:01 +00:00
committed by David S. Miller
parent 9835fd7321
commit 1853e2e15d
2 changed files with 29 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/s2io.h
View File

@@ -355,9 +355,8 @@ struct stat_block {
#define FIFO_OTHER_MAX_NUM 1
#define MAX_RX_DESC_1 (MAX_RX_RINGS * MAX_RX_BLOCKS_PER_RING * 127 )
#define MAX_RX_DESC_2 (MAX_RX_RINGS * MAX_RX_BLOCKS_PER_RING * 85 )
#define MAX_RX_DESC_3 (MAX_RX_RINGS * MAX_RX_BLOCKS_PER_RING * 85 )
#define MAX_RX_DESC_1 (MAX_RX_RINGS * MAX_RX_BLOCKS_PER_RING * 128)
#define MAX_RX_DESC_2 (MAX_RX_RINGS * MAX_RX_BLOCKS_PER_RING * 86)
#define MAX_TX_DESC (MAX_AVAILABLE_TXDS)
/* FIFO mappings for all possible number of fifos configured */