diff options
| author | Andi Kleen <[email protected]> | 2013-09-30 13:29:08 -0700 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2013-10-02 16:31:48 -0400 |
| commit | 58e4e1f6cacddb7823c44bcfb272174553f6c645 (patch) | |
| tree | e049258977c26dabda0eb8824fa3f63788493968 | |
| parent | 52f77ba9256bc9dc0f7e6b37b03d00553e903d15 (diff) | |
igb: Avoid uninitialized advertised variable in eee_set_cur
eee_get_cur assumes that the output data is already zeroed. It can
read-modify-write the advertised field:
if (ipcnfg & E1000_IPCNFG_EEE_100M_AN)
2594 edata->advertised |= ADVERTISED_100baseT_Full;
This is ok for the normal ethtool eee_get call, which always
zeroes the input data before.
But eee_set_cur also calls eee_get_cur and it did not zero the input
field. Later on it then compares agsinst the field, which can contain partial
stack garbage.
Zero the input field in eee_set_cur() too.
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Andi Kleen <[email protected]>
Acked-by: Jeff Kirsher <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
| -rw-r--r-- | drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c index 86d51429a189..151e00cad113 100644 --- a/drivers/net/ethernet/intel/igb/igb_ethtool.c +++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c @@ -2655,6 +2655,8 @@ static int igb_set_eee(struct net_device *netdev, (hw->phy.media_type != e1000_media_type_copper)) return -EOPNOTSUPP; + memset(&eee_curr, 0, sizeof(struct ethtool_eee)); + ret_val = igb_get_eee(netdev, &eee_curr); if (ret_val) return ret_val; |