net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss()

Browse source

The value adapter->rss_conf is stored in DMA memory, and it is assigned
to rssConf, so rssConf->indTableSize can be modified at anytime by
malicious hardware. Because rssConf->indTableSize is assigned to n,
buffer overflow may occur when the code "rssConf->indTable[n]" is
executed.

To fix this possible bug, n is checked after being used.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Jia-Ju Bai 2020-05-30 10:41:50 +08:00 • committed by David S. Miller

parent 0af413bd3e

commit 3e1c6846b9

1 changed files with 2 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

2

drivers/net/vmxnet3/vmxnet3_ethtool.c

View file