cxgb3: fix out of bounds read
authorMichal Schmidt <mschmidt@redhat.com>
Fri, 29 Apr 2016 09:06:50 +0000 (11:06 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 2 May 2016 00:59:43 +0000 (20:59 -0400)
commit0b86a2a1e5807326f8eb44e9919d0baadeda3a69
tree404940448a1d0328d423331e1390b2e1fb545b28
parentc489565b536ff5382460273fd9513f0adebec024
cxgb3: fix out of bounds read

An out of bounds read of 2 bytes was discovered in cxgb3 with KASAN.

t3_config_rss() expects both arrays it gets as parameters to have
terminators. setup_rss(), the caller, forgets to add a terminator to
one of the arrays. Thankfully the iteration in t3_config_rss() stops
anyway, but in the last iteration the check for the terminator
is an out of bounds read.

Add the missing terminator to rspq_map[].

Reported-by: Jan Stancek <jstancek@redhat.com>
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c