Michal Schmidt 0b86a2a1e5 cxgb3: fix out of bounds read ...

An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN.

t3_config_rss() expects both arrays it gets as parameters to have
terminators. setup_rss(), the caller, forgets to add a terminator to
one of the arrays. Thankfully the iteration in t3_config_rss() stops
anyway, but in the last iteration the check for the terminator
is an out of bounds read.

Add the missing terminator to rspq_map[].

Reported-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2016-05-01 20:59:43 -04:00

..

adapter.h

…

ael1002.c

chelsio: constify cphy_ops structures

2016-01-04 21:58:28 -05:00

aq100x.c

chelsio: constify cphy_ops structures

2016-01-04 21:58:28 -05:00

common.h

chelsio: constify cphy_ops structures

2016-01-04 21:58:28 -05:00

cxgb3_ctl_defs.h

…

cxgb3_defs.h

…

cxgb3_ioctl.h

…

cxgb3_main.c

cxgb3: fix out of bounds read

2016-05-01 20:59:43 -04:00

cxgb3_offload.c

cxgb3: use kvfree() in cxgb_free_mem()

2015-06-30 19:44:59 -07:00

cxgb3_offload.h

…

firmware_exports.h

…

l2t.c

net: cxgb3: slight optimization of addr compare

2013-12-31 16:48:30 -05:00

l2t.h

cxgb3: Convert t3_l2t_get() over to dst_neigh_lookup().

2012-07-05 02:29:40 -07:00

Makefile

…

mc5.c

net: ethernet: chelsio: cxgb3: mc5.c: Remove some unused functions

2015-01-02 16:32:37 -05:00

regs.h

chelsio: remove duplicate defines

2013-10-21 18:46:45 -04:00

sge_defs.h

…

sge.c

cxgb3/4/4vf: Update drivers to use dma_rmb/wmb where appropriate

2015-04-09 14:25:25 -04:00

t3_cpl.h

…

t3_hw.c

cxgb3: fix up vpd strings for kstrto*()

2016-02-19 15:49:31 -05:00

t3cdev.h

…

version.h

cxgb3: update firmware version

2012-02-15 15:48:19 -05:00

vsc8211.c

chelsio: constify cphy_ops structures

2016-01-04 21:58:28 -05:00

xgmac.c

…