https://github.com/torvalds/linux
Revision babd6134a54d70efe875fa5661a20eaecb63f278 authored by Roi Dayan on 18 September 2016, 15:20:27 UTC, committed by David S. Miller on 20 September 2016, 02:10:15 UTC
The FW command output length should be only the length of struct
mlx5_cmd_fc_bulk out field. Failing to do so will cause the memcpy
call which is invoked later in the driver to write over wrong memory
address and corrupt kernel memory which results in random crashes.

This bug was found using the kernel address sanitizer (kasan).

Fixes: a351a1b03bf1 ('net/mlx5: Introduce bulk reading of flow counters')
Signed-off-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 7ac3273
History
Tip revision: babd6134a54d70efe875fa5661a20eaecb63f278 authored by Roi Dayan on 18 September 2016, 15:20:27 UTC
net/mlx5: Fix flow counter bulk command out mailbox allocation
Tip revision: babd613
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitignore -rw-r--r-- 1.3 KB
.mailmap -rw-r--r-- 7.3 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 95.5 KB
Kbuild -rw-r--r-- 2.8 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 363.6 KB
Makefile -rw-r--r-- 56.8 KB
README -rw-r--r-- 18.1 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top