| From cd4de0b6400b203eafbdc19b0458bd18c2ab279b Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 19 May 2020 09:05:58 +0800 |
| Subject: net: bmac: Fix read of MAC address from ROM |
| |
| From: Jeremy Kerr <jk@ozlabs.org> |
| |
| [ Upstream commit ef01cee2ee1b369c57a936166483d40942bcc3e3 ] |
| |
| In bmac_get_station_address, We're reading two bytes at a time from ROM, |
| but we do that six times, resulting in 12 bytes of read & writes. This |
| means we will write off the end of the six-byte destination buffer. |
| |
| This change fixes the for-loop to only read/write six bytes. |
| |
| Based on a proposed fix from Finn Thain <fthain@telegraphics.com.au>. |
| |
| Signed-off-by: Jeremy Kerr <jk@ozlabs.org> |
| Reported-by: Stan Johnson <userm57@yahoo.com> |
| Tested-by: Stan Johnson <userm57@yahoo.com> |
| Reported-by: Finn Thain <fthain@telegraphics.com.au> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/apple/bmac.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/net/ethernet/apple/bmac.c b/drivers/net/ethernet/apple/bmac.c |
| index a65d7a60f116..ffa7e7e6d18d 100644 |
| --- a/drivers/net/ethernet/apple/bmac.c |
| +++ b/drivers/net/ethernet/apple/bmac.c |
| @@ -1187,7 +1187,7 @@ bmac_get_station_address(struct net_device *dev, unsigned char *ea) |
| int i; |
| unsigned short data; |
| |
| - for (i = 0; i < 6; i++) |
| + for (i = 0; i < 3; i++) |
| { |
| reset_and_select_srom(dev); |
| data = read_srom(dev, i + EnetAddressOffset/2, SROMAddressBits); |
| -- |
| 2.25.1 |
| |
