summaryrefslogtreecommitdiff
path: root/target/linux/generic
diff options
context:
space:
mode:
authorJonas Gorski <jogo@openwrt.org>2015-06-10 09:21:36 +0000
committerJonas Gorski <jogo@openwrt.org>2015-06-10 09:21:36 +0000
commit9fbd6d0ba0af16648e9d6b70bab953184a263d94 (patch)
treea8526e3a38857c01cd359c5cb6dcd5857dd4504e /target/linux/generic
parentd24d5412fff17cc0ddafecc47ca9564795e1df3a (diff)
downloadmtk-20170518-9fbd6d0ba0af16648e9d6b70bab953184a263d94.zip
mtk-20170518-9fbd6d0ba0af16648e9d6b70bab953184a263d94.tar.gz
mtk-20170518-9fbd6d0ba0af16648e9d6b70bab953184a263d94.tar.bz2
b53: fix memory out of bounds access on 64 bit targets
On device reset the sizes for the vlan and port tables were wrongly calculated based on the pointer size instead of the struct size. This causes buffer overruns on 64 bit targets, resulting in panics. Fix this by dereferencing the pointers. Reported-by: Fedor Konstantinov <blmink@mink.su> Signed-off-by: Jonas Gorski <jogo@openwrt.org> SVN-Revision: 45938
Diffstat (limited to 'target/linux/generic')
-rw-r--r--target/linux/generic/files/drivers/net/phy/b53/b53_common.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/target/linux/generic/files/drivers/net/phy/b53/b53_common.c b/target/linux/generic/files/drivers/net/phy/b53/b53_common.c
index 2b05d5d..47b5a8b 100644
--- a/target/linux/generic/files/drivers/net/phy/b53/b53_common.c
+++ b/target/linux/generic/files/drivers/net/phy/b53/b53_common.c
@@ -803,8 +803,8 @@ static int b53_global_reset_switch(struct switch_dev *dev)
priv->enable_jumbo = 0;
priv->allow_vid_4095 = 0;
- memset(priv->vlans, 0, sizeof(priv->vlans) * dev->vlans);
- memset(priv->ports, 0, sizeof(priv->ports) * dev->ports);
+ memset(priv->vlans, 0, sizeof(*priv->vlans) * dev->vlans);
+ memset(priv->ports, 0, sizeof(*priv->ports) * dev->ports);
return b53_switch_reset(priv);
}