e100, e1000, ixgb: Fix an impossible memory overwrite bug
We keep getting requests from people that think that this might be an exploitable hole where we would overwrite 4 bytes in the netdev struct if the pci name would exceed 15 characters. In reality this will never happen but we fix it anyway. Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
This commit is contained in:
parent
0abb6eb128
commit
0eb5a34cdf
3 changed files with 3 additions and 3 deletions
|
@ -2572,7 +2572,7 @@ static int __devinit e100_probe(struct pci_dev *pdev,
|
||||||
#ifdef CONFIG_NET_POLL_CONTROLLER
|
#ifdef CONFIG_NET_POLL_CONTROLLER
|
||||||
netdev->poll_controller = e100_netpoll;
|
netdev->poll_controller = e100_netpoll;
|
||||||
#endif
|
#endif
|
||||||
strcpy(netdev->name, pci_name(pdev));
|
strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
|
||||||
|
|
||||||
nic = netdev_priv(netdev);
|
nic = netdev_priv(netdev);
|
||||||
nic->netdev = netdev;
|
nic->netdev = netdev;
|
||||||
|
|
|
@ -759,7 +759,7 @@ e1000_probe(struct pci_dev *pdev,
|
||||||
#ifdef CONFIG_NET_POLL_CONTROLLER
|
#ifdef CONFIG_NET_POLL_CONTROLLER
|
||||||
netdev->poll_controller = e1000_netpoll;
|
netdev->poll_controller = e1000_netpoll;
|
||||||
#endif
|
#endif
|
||||||
strcpy(netdev->name, pci_name(pdev));
|
strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
|
||||||
|
|
||||||
netdev->mem_start = mmio_start;
|
netdev->mem_start = mmio_start;
|
||||||
netdev->mem_end = mmio_start + mmio_len;
|
netdev->mem_end = mmio_start + mmio_len;
|
||||||
|
|
|
@ -437,7 +437,7 @@ ixgb_probe(struct pci_dev *pdev,
|
||||||
netdev->poll_controller = ixgb_netpoll;
|
netdev->poll_controller = ixgb_netpoll;
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
strcpy(netdev->name, pci_name(pdev));
|
strncpy(netdev->name, pci_name(pdev), sizeof(netdev->name) - 1);
|
||||||
netdev->mem_start = mmio_start;
|
netdev->mem_start = mmio_start;
|
||||||
netdev->mem_end = mmio_start + mmio_len;
|
netdev->mem_end = mmio_start + mmio_len;
|
||||||
netdev->base_addr = adapter->hw.io_base;
|
netdev->base_addr = adapter->hw.io_base;
|
||||||
|
|
Reference in a new issue