Skip to content

Commit

Permalink
qlcnic: Fix memory corruption while reading stats using ethtool.
Browse files Browse the repository at this point in the history
o  Driver is doing memset with zero for total number of stats bytes when
   it has already filled some data in the stats buffer, which can overwrite
   memory area beyond the length of stats buffer.

o  Fix this by initializing stats buffer with zero before filling any data in it.

Signed-off-by: Manish Chopra <manish.chopra@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Manish Chopra authored and David S. Miller committed Sep 26, 2014
1 parent 4324414 commit c023030
Showing 1 changed file with 2 additions and 4 deletions.
6 changes: 2 additions & 4 deletions drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
Original file line number Diff line number Diff line change
Expand Up @@ -1333,12 +1333,11 @@ static void qlcnic_get_ethtool_stats(struct net_device *dev,
struct qlcnic_host_tx_ring *tx_ring;
struct qlcnic_esw_statistics port_stats;
struct qlcnic_mac_statistics mac_stats;
int index, ret, length, size, tx_size, ring;
int index, ret, length, size, ring;
char *p;

tx_size = adapter->drv_tx_rings * QLCNIC_TX_STATS_LEN;
memset(data, 0, stats->n_stats * sizeof(u64));

memset(data, 0, tx_size * sizeof(u64));
for (ring = 0, index = 0; ring < adapter->drv_tx_rings; ring++) {
if (test_bit(__QLCNIC_DEV_UP, &adapter->state)) {
tx_ring = &adapter->tx_ring[ring];
Expand All @@ -1347,7 +1346,6 @@ static void qlcnic_get_ethtool_stats(struct net_device *dev,
}
}

memset(data, 0, stats->n_stats * sizeof(u64));
length = QLCNIC_STATS_LEN;
for (index = 0; index < length; index++) {
p = (char *)adapter + qlcnic_gstrings_stats[index].stat_offset;
Expand Down

0 comments on commit c023030

Please sign in to comment.