linux-mips
[Top] [All Lists]

[PATCH V2] MIPS: BCM63XX: properly handle mac address octet overflow

To: Ralf Baechle <ralf@linux-mips.org>
Subject: [PATCH V2] MIPS: BCM63XX: properly handle mac address octet overflow
From: Jonas Gorski <jonas.gorski@gmail.com>
Date: Tue, 18 Sep 2012 14:09:08 +0200
Cc: linux-mips@linux-mips.org, Maxime Bizon <mbizon@freebox.fr>, Florian Fainelli <florian@openwrt.org>, Sergei Shtylyov <sshtylyov@mvista.com>
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:x-mailer:in-reply-to:references; bh=EceTQEuvVbbTpm/sLkVxFQtHLPfI5GLD7CtbRzW/7Qw=; b=dFN1r0JV5GUZ2a+E/P6fIbZGmXu29kIPZ9GRrooV1ts6LQ3t4d73709RO0PL439DhT KiWq392fKuwNC3IJOVTkFKwnZk7fPJOW3uI55Z0FyLJW4bfcPnt3LASJ7JdcJAm50dzV ao5rGOORyOWb3fDu6YuIzw+MRB2sfH/nj/mwkAQqu194F9tb1j21iF7cXbSbYwK28mf3 1/EpanIGUdYOPTiyjKI7TWLKnXlcUub/qLkD0ysuVcrX4YUOCBf/HQCTU6fwTqAPOPlo VYgmIGgvocwLC3jDSe8CFohAkEhvtSlPZIFaT0BA95UieIyRIRPlPlY9KovlP8sIqqzw +ITA==
In-reply-to: <1347960728-5884-1-git-send-email-jonas.gorski@gmail.com>
List-archive: <http://www.linux-mips.org/archives/linux-mips/>
List-help: <mailto:ecartis@linux-mips.org?Subject=help>
List-id: linux-mips <linux-mips.eddie.linux-mips.org>
List-owner: <mailto:ralf@linux-mips.org>
List-post: <mailto:linux-mips@linux-mips.org>
List-software: Ecartis version 1.0.0
List-subscribe: <mailto:ecartis@linux-mips.org?subject=subscribe%20linux-mips>
List-unsubscribe: <mailto:ecartis@linux-mips.org?subject=unsubscribe%20linux-mips>
References: <1347960728-5884-1-git-send-email-jonas.gorski@gmail.com>
Sender: linux-mips-bounce@linux-mips.org
While calculating the mac address the pointer for the current octet was
never reset back to the least significant one after being decremented
because of an octet overflow. This resulted in the code continuing to
increment at the current octet, potentially generating duplicate or
invalid mac addresses.

As a second issue the pointer was allowed to advance up to the most
significant octet, modifying the OUI, and potentially changing the type
of mac address.

Rewrite the code so it resets the pointer to the least significant
in each outer loop step, and bails out when the least significant octet
of the OUI is reached.

Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
---

V1 -> V2: add a missing variable declaration breaking the compilation.

 arch/mips/bcm63xx/boards/board_bcm963xx.c |   16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c 
b/arch/mips/bcm63xx/boards/board_bcm963xx.c
index ea4ea77..442ba96 100644
--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
+++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
@@ -720,7 +720,7 @@ const char *board_get_name(void)
  */
 static int board_get_mac_address(u8 *mac)
 {
-       u8 *p;
+       u8 *oui;
        int count;
 
        if (mac_addr_used >= nvram.mac_addr_count) {
@@ -729,21 +729,23 @@ static int board_get_mac_address(u8 *mac)
        }
 
        memcpy(mac, nvram.mac_addr_base, ETH_ALEN);
-       p = mac + ETH_ALEN - 1;
+       oui = mac + ETH_ALEN/2 - 1;
        count = mac_addr_used;
 
        while (count--) {
+               u8 *p = mac + ETH_ALEN - 1;
+
                do {
                        (*p)++;
                        if (*p != 0)
                                break;
                        p--;
-               } while (p != mac);
-       }
+               } while (p != oui);
 
-       if (p == mac) {
-               printk(KERN_ERR PFX "unable to fetch mac address\n");
-               return -ENODEV;
+               if (p == oui) {
+                       printk(KERN_ERR PFX "unable to fetch mac address\n");
+                       return -ENODEV;
+               }
        }
 
        mac_addr_used++;
-- 
1.7.10.4


<Prev in Thread] Current Thread [Next in Thread>