renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-22 20:23:57 +08:00
Code

IB/ipath: Limit length checksummed in eeprom

Browse Source 
The small eeprom that holds the GUID etc. contains a data-length, but if 
the actual eeprom is new or has been erased, that byte will be 0xFF,
which is greater than the maximum physical length of the eeprom, and
more importantly greater than the length of the buffer we vmalloc'd.
Sanity-check the length to avoid the possbility of reading past end of
buffer.

Signed-off-by: Michael Albaugh <Michael.Albaugh@Qlogic.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Michael Albaugh 2007-10-18 10:36:40 -07:00 committed by Roland Dreier
parent fffbfeaa68
commit 627934448e
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/infiniband/hw/ipath/ipath_eeprom.c
View File

@ -538,7 +538,15 @@ static u8 flash_csum(struct ipath_flash *ifp, int adjust)
u8 *ip = (u8 *) ifp;
u8 csum = 0, len;
for (len = 0; len < ifp->if_length; len++)
/*
* Limit length checksummed to max length of actual data.
* Checksum of erased eeprom will still be bad, but we avoid
* reading past the end of the buffer we were passed.
*/
len = ifp->if_length;
if (len > sizeof(struct ipath_flash))
len = sizeof(struct ipath_flash);
while (len--)
csum += *ip++;
csum -= ifp->if_csum;
csum = ~csum;