linux/drivers/net
Sasha Neftin 7b69c07beb e1000e: Fix possible overflow in LTR decoding
commit 04ebaa1cfd upstream.

When we decode the latency and the max_latency, u16 value may not fit
the required size and could lead to the wrong LTR representation.

Scaling is represented as:
scale 0 - 1         (2^(5*0)) = 2^0
scale 1 - 32        (2^(5 *1))= 2^5
scale 2 - 1024      (2^(5 *2)) =2^10
scale 3 - 32768     (2^(5 *3)) =2^15
scale 4 - 1048576   (2^(5 *4)) = 2^20
scale 5 - 33554432  (2^(5 *4)) = 2^25
scale 4 and scale 5 required 20 and 25 bits respectively.
scale 6 reserved.

Replace the u16 type with the u32 type and allow corrected LTR
representation.

Cc: stable@vger.kernel.org
Fixes: 44a13a5d99 ("e1000e: Fix the max snoop/no-snoop latency for 10M")
Reported-by: James Hutchinson <jahutchinson99@googlemail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=215689
Suggested-by: Dima Ruinskiy <dima.ruinskiy@intel.com>
Signed-off-by: Sasha Neftin <sasha.neftin@intel.com>
Tested-by: Naama Meir <naamax.meir@linux.intel.com>
Tested-by: James Hutchinson <jahutchinson99@googlemail.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-04-27 14:39:00 +02:00
..
appletalk
arcnet net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() 2022-03-08 19:12:46 +01:00
bonding bonding: fix data-races around agg_select_timer 2022-02-23 12:03:12 +01:00
caif
can can: etas_es58x: es58x_fd_rx_event_msg(): initialize rx_event_msg before calling es58x_check_msg_len() 2022-04-13 20:59:08 +02:00
dsa net: dsa: felix: suppress -EPROBE_DEFER errors 2022-04-20 09:34:10 +02:00
ethernet e1000e: Fix possible overflow in LTR decoding 2022-04-27 14:39:00 +02:00
fddi
fjes
hamradio hamradio: remove needs_free_netdev to avoid UAF 2022-04-20 09:34:04 +02:00
hippi
hyperv hv_netvsc: Add check for kvmalloc_array 2022-03-23 09:16:42 +01:00
ieee802154 net: ieee802154: ca8210: Fix lifs/sifs periods 2022-02-23 12:03:11 +01:00
ipa net: ipa: fix a build dependency 2022-04-20 09:34:21 +02:00
ipvlan
mctp
mdio net: mdio: don't defer probe forever if PHY IRQ provider is missing 2022-04-20 09:34:10 +02:00
netdevsim ipv6: fix data-race in fib6_info_hw_flags_set / fib6_purge_rt 2022-02-23 12:03:10 +01:00
pcs
phy net: sfp: add 2500base-X quirk for Lantech SFP module 2022-04-13 20:59:09 +02:00
plip
ppp
slip drivers: net: slip: fix NPD bug in sl_tx_timeout() 2022-04-20 09:34:17 +02:00
team
usb net: usb: aqc111: Fix out-of-bounds accesses in RX fixup 2022-04-20 09:34:16 +02:00
vmxnet3
wan
wireguard wireguard: socket: ignore v6 endpoints when ipv6 is disabled 2022-04-08 14:24:09 +02:00
wireless brcmfmac: sdio: Fix undefined behavior due to shift overflowing the constant 2022-04-27 14:38:56 +02:00
wwan net: wwan: Fix MRU mismatch issue which may lead to data connection lost 2022-01-27 11:05:40 +01:00
xen-netback Revert "xen-netback: Check for hotplug-status existence before watching" 2022-03-16 14:23:41 +01:00
bareudp.c bareudp: use ipv6_mod_enabled to check if IPv6 enabled 2022-04-08 14:23:41 +02:00
dummy.c
eql.c
geneve.c
gtp.c
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c net: macsec: Verify that send_sci is on when setting Tx sci explicitly 2022-02-08 18:34:09 +01:00
macvlan.c macvlan: Fix leaking skb in source mode with nodst option 2022-04-20 09:34:13 +02:00
macvtap.c macvtap: advertise link netns via netlink 2022-04-13 20:59:07 +02:00
Makefile
mdio.c
mhi_net.c
mii.c
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c tuntap: add sanity checks about msg_controllen in sendmsg 2022-04-13 20:59:07 +02:00
thunderbolt.c
tun.c tuntap: add sanity checks about msg_controllen in sendmsg 2022-04-13 20:59:07 +02:00
veth.c veth: Ensure eth header is in skb's linear part 2022-04-20 09:34:10 +02:00
virtio_net.c
vrf.c vrf: fix packet sniffing for traffic originating from ip tunnels 2022-04-13 20:59:15 +02:00
vsockmon.c
vxlan.c vxlan: fix error return code in vxlan_fdb_append 2022-04-27 14:38:55 +02:00
xen-netfront.c xen/netfront: react properly to failing gnttab_end_foreign_access_ref() 2022-03-11 12:22:37 +01:00