From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dispatch1-us1.ppe-hosted.com (dispatch1-us1.ppe-hosted.com [67.231.154.164]) by dpdk.org (Postfix) with ESMTP id 43A6B378E; Tue, 4 Apr 2017 14:13:39 +0200 (CEST) Received: from pure.maildistiller.com (unknown [10.110.50.29]) by dispatch1-us1.ppe-hosted.com (Proofpoint Essentials ESMTP Server) with ESMTP id 9ED8680091; Tue, 4 Apr 2017 12:13:38 +0000 (UTC) X-Virus-Scanned: Proofpoint Essentials engine Received: from mx4-us4.ppe-hosted.com (unknown [10.110.49.251]) by pure.maildistiller.com (Proofpoint Essentials ESMTP Server) with ESMTPS id 5F54E80049; Tue, 4 Apr 2017 12:13:38 +0000 (UTC) Received: from webmail.solarflare.com (webmail.solarflare.com [12.187.104.26]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx4-us4.ppe-hosted.com (Proofpoint Essentials ESMTP Server) with ESMTPS id 3543460060; Tue, 4 Apr 2017 12:13:36 +0000 (UTC) Received: from ocex03.SolarFlarecom.com (10.20.40.36) by ocex03.SolarFlarecom.com (10.20.40.36) with Microsoft SMTP Server (TLS) id 15.0.1044.25; Tue, 4 Apr 2017 05:13:30 -0700 Received: from opal.uk.solarflarecom.com (10.17.10.1) by ocex03.SolarFlarecom.com (10.20.40.36) with Microsoft SMTP Server (TLS) id 15.0.1044.25 via Frontend Transport; Tue, 4 Apr 2017 05:13:29 -0700 Received: from uklogin.uk.solarflarecom.com (uklogin.uk.solarflarecom.com [10.17.10.10]) by opal.uk.solarflarecom.com (8.13.8/8.13.8) with ESMTP id v34CDSgO015148; Tue, 4 Apr 2017 13:13:28 +0100 Received: from uklogin.uk.solarflarecom.com (localhost.localdomain [127.0.0.1]) by uklogin.uk.solarflarecom.com (8.13.8/8.13.8) with ESMTP id v34CDSv1018586; Tue, 4 Apr 2017 13:13:28 +0100 From: Andrew Rybchenko To: CC: Andy Moreton , Date: Tue, 4 Apr 2017 13:13:26 +0100 Message-ID: <1491308007-18550-2-git-send-email-arybchenko@solarflare.com> X-Mailer: git-send-email 1.8.2.3 In-Reply-To: <1491308007-18550-1-git-send-email-arybchenko@solarflare.com> References: <1491308007-18550-1-git-send-email-arybchenko@solarflare.com> MIME-Version: 1.0 Content-Type: text/plain X-MDID: 1491308018-05zCFL3i9YES Subject: [dpdk-stable] [PATCH 2/3] net/sfc/base: fix potential buffer overflow in Tx queue init X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Apr 2017 12:13:40 -0000 From: Andy Moreton Improve error checking to avoid a caller overflowing the MCDI request buffer if the requested TXQ size was excessively large. Coverity issue: 1305527 Fixes: e7cd430c864f ("net/sfc/base: import SFN7xxx family support") CC: stable@dpdk.org Signed-off-by: Andy Moreton Signed-off-by: Andrew Rybchenko --- drivers/net/sfc/base/ef10_tx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/sfc/base/ef10_tx.c b/drivers/net/sfc/base/ef10_tx.c index 6ad11dd..0f8e9b1 100644 --- a/drivers/net/sfc/base/ef10_tx.c +++ b/drivers/net/sfc/base/ef10_tx.c @@ -67,7 +67,7 @@ efx_mcdi_init_txq( EFX_TXQ_NBUFS(enp->en_nic_cfg.enc_txq_max_ndescs)); npages = EFX_TXQ_NBUFS(size); - if (npages > MC_CMD_INIT_TXQ_IN_DMA_ADDR_MAXNUM) { + if (MC_CMD_INIT_TXQ_IN_LEN(npages) > sizeof (payload)) { rc = EINVAL; goto fail1; } -- 2.7.4