]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
tg3: fix length overflow in VPD firmware parsing
authorKees Cook <keescook@chromium.org>
Wed, 27 Mar 2013 06:40:50 +0000 (06:40 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 27 Mar 2013 18:06:41 +0000 (14:06 -0400)
commit715230a44310a8cf66fbfb5a46f9a62a9b2de424
tree1b621108e9446c1b352ba9a3f2b573b99dd688c9
parentea872d7712528ad991bdabb63515bc00ee10993e
tg3: fix length overflow in VPD firmware parsing

Commit 184b89044fb6e2a74611dafa69b1dce0d98612c6 ("tg3: Use VPD fw version
when present") introduced VPD parsing that contained a potential length
overflow.

Limit the hardware's reported firmware string length (max 255 bytes) to
stay inside the driver's firmware string length (32 bytes). On overflow,
truncate the formatted firmware string instead of potentially overwriting
portions of the tg3 struct.

http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf

Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Oded Horovitz <oded@privatecore.com>
Reported-by: Brad Spengler <spender@grsecurity.net>
Cc: stable@vger.kernel.org
Cc: Matt Carlson <mcarlson@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/broadcom/tg3.c