Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 21 Mar 2018 20:13:24 +0000 (UTC)
From:      Navdeep Parhar <np@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org
Subject:   svn commit: r331320 - stable/10/sys/dev/cxgb
Message-ID:  <201803212013.w2LKDOVU064104@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: np
Date: Wed Mar 21 20:13:24 2018
New Revision: 331320
URL: https://svnweb.freebsd.org/changeset/base/331320

Log:
  MFC r328315:
  
  cxgb(4): Validate offset/len in the GET_EEPROM ioctl.
  
  Sponsored by:	Chelsio Communications.

Modified:
  stable/10/sys/dev/cxgb/cxgb_main.c

Modified: stable/10/sys/dev/cxgb/cxgb_main.c
==============================================================================
--- stable/10/sys/dev/cxgb/cxgb_main.c	Wed Mar 21 19:33:00 2018	(r331319)
+++ stable/10/sys/dev/cxgb/cxgb_main.c	Wed Mar 21 20:13:24 2018	(r331320)
@@ -2914,8 +2914,14 @@ cxgb_extension_ioctl(struct cdev *dev, unsigned long c
 	case CHELSIO_GET_EEPROM: {
 		int i;
 		struct ch_eeprom *e = (struct ch_eeprom *)data;
-		uint8_t *buf = malloc(EEPROMSIZE, M_DEVBUF, M_NOWAIT);
+		uint8_t *buf;
 
+		if (e->offset & 3 || e->offset >= EEPROMSIZE ||
+		    e->len > EEPROMSIZE || e->offset + e->len > EEPROMSIZE) {
+			return (EINVAL);
+		}
+
+		buf = malloc(EEPROMSIZE, M_DEVBUF, M_NOWAIT);
 		if (buf == NULL) {
 			return (ENOMEM);
 		}



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201803212013.w2LKDOVU064104>