Skip to contentSkip to conversation

davinci_emac: off by one

PATCH In review Dan Carpenter 2 participants 2 messages Mar 3, 2010

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 davinci_emac: off by one

This off by one error was found by smatch.

drivers/net/davinci_emac.c +2390 emac_dev_open(13) error: buffer overflow 'priv->mac_addr' 6 <= 6

---
I don't have the hardware to test this. If would be cool if someone would verify that the hardware still works after the patch is applied.

drivers/net/davinci_emac.c +1 -1
index 1605bc2..eab07cd 100644
@@ -2386,7 +2386,7 @@ static int emac_dev_open(struct net_device *ndev)
 	struct emac_priv *priv = netdev_priv(ndev);
 
 	netif_carrier_off(ndev);
-	for (cnt = 0; cnt <= ETH_ALEN; cnt++)
+	for (cnt = 0; cnt < ETH_ALEN; cnt++)
 		ndev->dev_addr[cnt] = priv->mac_addr[cnt];
 
 	/* Configuration items */
maintainer
#1 lore raw

From: Dan Carpenter <[email protected]>
Date: Wed, 3 Mar 2010 10:07:24 +0300

Quoted 8 lines

This off by one error was found by smatch.

drivers/net/davinci_emac.c +2390 emac_dev_open(13) error: buffer overflow 'priv->mac_addr' 6 <= 6

---
I don't have the hardware to test this. If would be cool if someone would verify that the hardware still works after the patch is applied.

It looks obvious enough for me, taking in more than 6 address bytes make no sense in an ethernet driver, so I'll apply this.

Thanks.