liquidio: off by one in liquidio_set_mcast_list()

PATCH In review Dan Carpenter 1 participant 1 message Jun 18, 2016

Subsystems (4)

Networking Network drivers Kernel janitors Cavium liquidio network driver

lore

Share & tools

lore

Dan Carpenter

author

2016-06-18 08:50 UTC #0 lore raw

PATCH 3/3 liquidio: off by one in liquidio_set_mcast_list()

The nctrl.udd[] array has 32 elements of size u64.

Imagine that netdev_mc_count() returns more than 32. That means "mc_count" is 32. On the last iteration through the loop we have mc = &nctrl.udd[32] so we're writing one element beyond the end of the array.

Fixes f21fb3ed364b ('Add support of Cavium Liquidio ethernet adapters')

Signed-off-by Dan Carpenter <[email protected]>

drivers/net/ethernet/cavium/liquidio/lio_main.c +1 -1

index 1126422..41ee8bd 100644
@@ -2376,7 +2376,7 @@ static void liquidio_set_mcast_list(struct net_device *netdev)
 		memcpy(((u8 *)mc) + 2, ha->addr, ETH_ALEN);
 		/* no need to swap bytes */
 
-		if (++mc > &nctrl.udd[mc_count])
+		if (++mc >= &nctrl.udd[mc_count])
 			break;
 	}