diff options
| author |   Kees Cook <keescook@chromium.org> | 2021-06-21 15:21:12 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2021-06-22 10:20:51 -0700 |
| commit | f2fcffe392c1fd8324f131bf33d7d350eff44bb6 (patch) | |
| tree | fb85680aff5b1a0069ef6d1ce0bc5974776fe449 /drivers/net/hyperv/rndis_filter.c | |
| parent | net: dsa: b53: Create default VLAN entry explicitly (diff) | |
| download | wireguard-linux-f2fcffe392c1fd8324f131bf33d7d350eff44bb6.tar.xz wireguard-linux-f2fcffe392c1fd8324f131bf33d7d350eff44bb6.zip | |
hv_netvsc: Avoid field-overflowing memcpy()
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring fields.
Add flexible array to represent start of buf_info, improving readability
and avoid future warning where memcpy() thinks it is writing past the
end of the structure.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/hyperv/rndis_filter.c')
| -rw-r--r-- | drivers/net/hyperv/rndis_filter.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c index c0e89e107d57..033ed6ed78c5 100644 --- a/drivers/net/hyperv/rndis_filter.c +++ b/drivers/net/hyperv/rndis_filter.c @@ -1051,10 +1051,8 @@ static int rndis_filter_set_packet_filter(struct rndis_device *dev, set = &request->request_msg.msg.set_req; set->oid = RNDIS_OID_GEN_CURRENT_PACKET_FILTER; set->info_buflen = sizeof(u32); - set->info_buf_offset = sizeof(struct rndis_set_request); - - memcpy((void *)(unsigned long)set + sizeof(struct rndis_set_request), - &new_filter, sizeof(u32)); + set->info_buf_offset = offsetof(typeof(*set), info_buf); + memcpy(set->info_buf, &new_filter, sizeof(u32)); ret = rndis_filter_send_request(dev, request); if (ret == 0) { |