Skip to content

Commit 31389b5

Browse files
finist0Jeff Kirsher
authored andcommitted
i40e: define proper net_device::neigh_priv_len
Out of bound read reported by KASan. i40iw_net_event() reads unconditionally 16 bytes from neigh->primary_key while the memory allocated for "neighbour" struct is evaluated in neigh_alloc() as tbl->entry_size + dev->neigh_priv_len where "dev" is a net_device. But the driver does not setup dev->neigh_priv_len and we read beyond the neigh entry allocated memory, so the patch in the next mail fixes this. Signed-off-by: Konstantin Khorenko <[email protected]> Tested-by: Andrew Bowers <[email protected]> Signed-off-by: Jeff Kirsher <[email protected]>
1 parent cd0d465 commit 31389b5

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

drivers/net/ethernet/intel/i40e/i40e_main.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12339,6 +12339,9 @@ static int i40e_config_netdev(struct i40e_vsi *vsi)
1233912339
ether_addr_copy(netdev->dev_addr, mac_addr);
1234012340
ether_addr_copy(netdev->perm_addr, mac_addr);
1234112341

12342+
/* i40iw_net_event() reads 16 bytes from neigh->primary_key */
12343+
netdev->neigh_priv_len = sizeof(u32) * 4;
12344+
1234212345
netdev->priv_flags |= IFF_UNICAST_FLT;
1234312346
netdev->priv_flags |= IFF_SUPP_NOFCS;
1234412347
/* Setup netdev TC information */

0 commit comments

Comments
 (0)