lkml.org 
[lkml]   [2023]   [Nov]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH] Prevent out-of-bounds read/write in bcmasp_netfilt_rd and bcmasp_netfilt_wr
    Date

    On a second thought, it might not be a good idea to return
    an error without modifying the caller, since the caller of
    this function currently uses this return value without checking
    if it's an error.
    I guess that explains why the first check returns 0.

    ```
    static int bcmasp_netfilt_wr_m_wake(struct bcmasp_priv *priv,
    ...
    {
    ...
    if (first_byte && (!IS_ALIGNED(offset, 4) || size < 3)) {
    match_val = bcmasp_netfilt_rd(priv, nfilt,
    ASP_NETFILT_MATCH,
    ALIGN_DOWN(offset, 4));
    mask_val = bcmasp_netfilt_rd(priv, nfilt,
    ASP_NETFILT_MASK,
    ALIGN_DOWN(offset, 4));
    }

    shift = (3 - (offset % 4)) * 8;
    match_val &= ~GENMASK(shift + 7, shift);
    mask_val &= ~GENMASK(shift + 7, shift);
    match_val |= (u32)(*((u8 *)match) << shift);
    mask_val |= (u32)(*((u8 *)mask) << shift);

    ```

    \
     
     \ /
      Last update: 2023-11-20 13:47    [W:2.832 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site