[PATCH master 4/7] net: gianfar: fix out of bounds read of local variable

Ahmad Fatoum a.fatoum at pengutronix.de
Sun Jun 4 23:29:36 PDT 2023


The MAC address will be written to two 32-bit registers. Because
MAC_ADDR_LEN == 6, this meant two bytes out-of-bounds where written to
the hardware register. Fix this by having them be in-bound and always
initialized to zero.

Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
 drivers/net/gianfar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 4b374b4a50de..10a95324920b 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -234,7 +234,7 @@ static int gfar_set_ethaddr(struct eth_device *edev, const unsigned char *mac)
 {
 	struct gfar_private *priv = edev->priv;
 	void __iomem *regs = priv->regs;
-	char tmpbuf[MAC_ADDR_LEN];
+	char tmpbuf[8] = {};
 	uint tempval;
 	int ix;
 
-- 
2.39.2




More information about the barebox mailing list