Messages in this thread | | | Date | Wed, 1 Mar 2023 16:13:40 +0100 | Subject | Re: [Intel-wired-lan] [PATCH net] ice: copy last block omitted in ice_get_module_eeprom() | From | Alexander Lobakin <> |
| |
From: Petr Oros <poros@redhat.com> Date: Tue, 28 Feb 2023 21:41:39 +0100
> ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice: > Reimplement module reads used by ethtool") In this refactor, > ice_get_module_eeprom() reads the eeprom in blocks of size 8. > But the condition that should protect the buffer overflow > ignores the last block. The last block always contains zeros. > Fix adding memcpy for last block.
[...]
> diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c > index b360bd8f15998b..33b2bee5cfb40f 100644 > --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c > +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c > @@ -4356,6 +4356,8 @@ ice_get_module_eeprom(struct net_device *netdev, > /* Make sure we have enough room for the new block */ > if ((i + SFF_READ_BLOCK_SIZE) < ee->len) > memcpy(data + i, value, SFF_READ_BLOCK_SIZE); > + else if (ee->len - i > 0) > + memcpy(data + i, value, ee->len - i);
Maybe just unify those two?
copy_len = min_t(u32, SFF_READ_BLOCK_SIZE, ee->len - i); memcpy(data + i, value, copy_len);
That's pretty much a reword of your code. The functional change is good to me.
> } > } > return 0;
Thanks, Olek
| |