Date: Wed, 21 Mar 2018 20:13:24 +0000 (UTC) From: Navdeep Parhar <np@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r331320 - stable/10/sys/dev/cxgb Message-ID: <201803212013.w2LKDOVU064104@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: np Date: Wed Mar 21 20:13:24 2018 New Revision: 331320 URL: https://svnweb.freebsd.org/changeset/base/331320 Log: MFC r328315: cxgb(4): Validate offset/len in the GET_EEPROM ioctl. Sponsored by: Chelsio Communications. Modified: stable/10/sys/dev/cxgb/cxgb_main.c Modified: stable/10/sys/dev/cxgb/cxgb_main.c ============================================================================== --- stable/10/sys/dev/cxgb/cxgb_main.c Wed Mar 21 19:33:00 2018 (r331319) +++ stable/10/sys/dev/cxgb/cxgb_main.c Wed Mar 21 20:13:24 2018 (r331320) @@ -2914,8 +2914,14 @@ cxgb_extension_ioctl(struct cdev *dev, unsigned long c case CHELSIO_GET_EEPROM: { int i; struct ch_eeprom *e = (struct ch_eeprom *)data; - uint8_t *buf = malloc(EEPROMSIZE, M_DEVBUF, M_NOWAIT); + uint8_t *buf; + if (e->offset & 3 || e->offset >= EEPROMSIZE || + e->len > EEPROMSIZE || e->offset + e->len > EEPROMSIZE) { + return (EINVAL); + } + + buf = malloc(EEPROMSIZE, M_DEVBUF, M_NOWAIT); if (buf == NULL) { return (ENOMEM); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201803212013.w2LKDOVU064104>