diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-02-29 21:17:08 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2012-03-01 17:23:42 -0500 |
| commit | 73f98eab9b9e0bab492ca06add5657d9e702ddb1 (patch) | |
| tree | ea1fd7e0d1cc84812f950b00c30fae6208ce2488 /drivers/net | |
| parent | 1e804aecd7d447d9a939a9376603008af65e52a0 (diff) | |
| download | linux-73f98eab9b9e0bab492ca06add5657d9e702ddb1.tar.bz2 | |
pch_gbe: memory corruption calling pch_gbe_validate_option()
pch_gbe_validate_option() modifies 32 bits of memory but we pass
&hw->phy.autoneg_advertised which only has 16 bits and &hw->mac.fc
which only has 8 bits.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c index 9cb5f912e489..29e23bec809c 100644 --- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c +++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c @@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter) pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n"); hw->phy.autoneg_advertised = opt.def; } else { - hw->phy.autoneg_advertised = AutoNeg; - pch_gbe_validate_option( - (int *)(&hw->phy.autoneg_advertised), - &opt, adapter); + int tmp = AutoNeg; + + pch_gbe_validate_option(&tmp, &opt, adapter); + hw->phy.autoneg_advertised = tmp; } } @@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter) .arg = { .l = { .nr = (int)ARRAY_SIZE(fc_list), .p = fc_list } } }; - hw->mac.fc = FlowControl; - pch_gbe_validate_option((int *)(&hw->mac.fc), - &opt, adapter); + int tmp = FlowControl; + + pch_gbe_validate_option(&tmp, &opt, adapter); + hw->mac.fc = tmp; } pch_gbe_check_copper_options(adapter); |