diff options
| author | Bruce Allan <bruce.w.allan@intel.com> | 2009-12-01 16:47:02 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-12-02 09:35:52 +0100 |
| commit | eb656d4552a6c9de5fdcee4a376b171f57b8a4a2 (patch) | |
| tree | e9b89b76b3bc1ca1347ce9051b007c16ee8ba81d /drivers/net/e1000e/es2lan.c | |
| parent | e1000e: provide family-specific functions to manage VLAN filter arrays (diff) | |
| download | linux-eb656d4552a6c9de5fdcee4a376b171f57b8a4a2.tar.xz linux-eb656d4552a6c9de5fdcee4a376b171f57b8a4a2.zip | |
e1000e: guard against buffer overflow in cable length tables
Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/e1000e/es2lan.c')
| -rw-r--r-- | drivers/net/e1000e/es2lan.c | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c index 3ff932f02f29..3f435c16608d 100644 --- a/drivers/net/e1000e/es2lan.c +++ b/drivers/net/e1000e/es2lan.c @@ -99,6 +99,8 @@ */ static const u16 e1000_gg82563_cable_length_table[] = { 0, 60, 115, 150, 150, 60, 115, 150, 180, 180, 0xFF }; +#define GG82563_CABLE_LENGTH_TABLE_SIZE \ + ARRAY_SIZE(e1000_gg82563_cable_length_table) static s32 e1000_setup_copper_link_80003es2lan(struct e1000_hw *hw); static s32 e1000_acquire_swfw_sync_80003es2lan(struct e1000_hw *hw, u16 mask); @@ -694,20 +696,27 @@ static s32 e1000_phy_force_speed_duplex_80003es2lan(struct e1000_hw *hw) static s32 e1000_get_cable_length_80003es2lan(struct e1000_hw *hw) { struct e1000_phy_info *phy = &hw->phy; - s32 ret_val; + s32 ret_val = 0; u16 phy_data, index; ret_val = e1e_rphy(hw, GG82563_PHY_DSP_DISTANCE, &phy_data); if (ret_val) - return ret_val; + goto out; index = phy_data & GG82563_DSPD_CABLE_LENGTH; + + if (index >= GG82563_CABLE_LENGTH_TABLE_SIZE - 5) { + ret_val = -E1000_ERR_PHY; + goto out; + } + phy->min_cable_length = e1000_gg82563_cable_length_table[index]; - phy->max_cable_length = e1000_gg82563_cable_length_table[index+5]; + phy->max_cable_length = e1000_gg82563_cable_length_table[index + 5]; phy->cable_length = (phy->min_cable_length + phy->max_cable_length) / 2; - return 0; +out: + return ret_val; } /** |