pch_gbe: memory corruption calling pch_gbe_validate_option()

commit 73f98eab9b9e0bab492ca06add5657d9e702ddb1 upstream.

pch_gbe_validate_option() modifies 32 bits of memory but we pass
&hw->phy.autoneg_advertised which only has 16 bits and &hw->mac.fc
which only has 8 bits.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/pch_gbe/pch_gbe_param.c b/drivers/net/pch_gbe/pch_gbe_param.c
index 5b5d90a..fb74ef9 100644 (file)
--- a/drivers/net/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/pch_gbe/pch_gbe_param.c
@@ -320,10 +320,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
                        pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
                        hw->phy.autoneg_advertised = opt.def;
                } else {
-                       hw->phy.autoneg_advertised = AutoNeg;
-                       pch_gbe_validate_option(
-                               (int *)(&hw->phy.autoneg_advertised),
-                               &opt, adapter);
+                       int tmp = AutoNeg;
+
+                       pch_gbe_validate_option(&tmp, &opt, adapter);
+                       hw->phy.autoneg_advertised = tmp;
                }
        }
 
@@ -494,9 +494,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
                                         .p = fc_list } }
                };
-               hw->mac.fc = FlowControl;
-               pch_gbe_validate_option((int *)(&hw->mac.fc),
-                                               &opt, adapter);
+               int tmp = FlowControl;
+
+               pch_gbe_validate_option(&tmp, &opt, adapter);
+               hw->mac.fc = tmp;
        }
 
        pch_gbe_check_copper_options(adapter);