Jia-Ju Bai 38b5dc60df net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss() ... [ Upstream commit 3e1c6846b9 ] The value adapter->rss_conf is stored in DMA memory, and it is assigned to rssConf, so rssConf->indTableSize can be modified at anytime by malicious hardware. Because rssConf->indTableSize is assigned to n, buffer overflow may occur when the code "rssConf->indTable[n]" is executed. To fix this possible bug, n is checked after being used. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-06-22 09:05:12 +02:00
..
Makefile
upt1_defs.h
vmxnet3_defs.h
vmxnet3_drv.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-05-21 16:01:54 -04:00
vmxnet3_ethtool.c	net: vmxnet3: fix possible buffer overflow caused by bad DMA value in vmxnet3_get_rss()	2020-06-22 09:05:12 +02:00
vmxnet3_int.h	vmxnet3: use DMA memory barriers where required	2018-05-14 22:43:57 -04:00