From: Jesper Dangaard Brouer <hawk@diku.dk>
To: linux-kernel@vger.kernel.org, jgarzik@mandrakesoft.com
Cc: tulip-devel@lists.sourceforge.net, tulip-users@lists.sourceforge.net
Subject: [PATCH] tulip driver, 2.4.0-test11 kernel, media type
Date: Thu, 7 Dec 2000 01:09:06 +0100 (CET) [thread overview]
Message-ID: <Pine.LNX.4.21.0012070102330.10746-200000@quark.diku.dk> (raw)
[-- Attachment #1: Type: TEXT/PLAIN, Size: 1548 bytes --]
Error/bug in the "tulip" network driver from the 2.4.0-test11 kernel, when
detecting media type.
The bug is quite simple. When detecting the media type, it's possible to
access data outside/beyond the array "medianame[]". This leads to an
kernel panic Oops.
I detected the bug, when using the netcard:
Phobos P430 Quad port (4 port card)
The card reports it's media type ("leaf->media") to be "17". And the
array "medianame" only contains 16 entries (0-15).
This patch only assures that we don't access elements beyond the static
size of the array (defensive coding).
We should of course expand the array "medianame" with the appropriate
entries. Note, that Donald Beckers version of the tulip driver have 8
extra elements in this array.
Jesper Brouer <hawk@diku.dk>
-------------------------------------------------------------------
System Administrator
Dept. of Computer Science, University of Copenhagen
E-mail: hawk@diku.dk, Direct Tel.: 353 21375
-------------------------------------------------------------------
The patch:
--- linux-2.4.0-test11/drivers/net/tulip/eeprom.c Mon Jun 19 22:42:39 2000
+++ linux/drivers/net/tulip/eeprom.c Wed Dec 6 23:03:10 2000
@@ -236,7 +236,8 @@
}
printk(KERN_INFO "%s: Index #%d - Media %s (#%d) described "
"by a %s (%d) block.\n",
- dev->name, i, medianame[leaf->media], leaf->media,
+ dev->name, i,
+ leaf->media < 16 ? medianame[leaf->media] : "UNKNOWN", leaf->media,
block_name[leaf->type], leaf->type);
}
if (new_advertise)
[-- Attachment #2: Type: TEXT/PLAIN, Size: 504 bytes --]
--- linux-2.4.0-test11/drivers/net/tulip/eeprom.c Mon Jun 19 22:42:39 2000
+++ linux/drivers/net/tulip/eeprom.c Wed Dec 6 23:03:10 2000
@@ -236,7 +236,8 @@
}
printk(KERN_INFO "%s: Index #%d - Media %s (#%d) described "
"by a %s (%d) block.\n",
- dev->name, i, medianame[leaf->media], leaf->media,
+ dev->name, i,
+ leaf->media < 16 ? medianame[leaf->media] : "UNKNOWN", leaf->media,
block_name[leaf->type], leaf->type);
}
if (new_advertise)
reply other threads:[~2000-12-07 0:39 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Pine.LNX.4.21.0012070102330.10746-200000@quark.diku.dk \
--to=hawk@diku.dk \
--cc=jgarzik@mandrakesoft.com \
--cc=linux-kernel@vger.kernel.org \
--cc=tulip-devel@lists.sourceforge.net \
--cc=tulip-users@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).