From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mx0b-0016ce01.pphosted.com (mx0a-0016ce01.pphosted.com [67.231.148.157]) by dpdk.org (Postfix) with ESMTP id 68A5E2C23 for ; Mon, 27 Feb 2017 08:52:24 +0100 (CET) Received: from pps.filterd (m0095336.ppops.net [127.0.0.1]) by mx0a-0016ce01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v1R7lQis002417; Sun, 26 Feb 2017 23:52:21 -0800 Received: from avcashub1.qlogic.com ([198.186.0.117]) by mx0a-0016ce01.pphosted.com with ESMTP id 28u8w8k222-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Sun, 26 Feb 2017 23:52:21 -0800 Received: from avluser05.qlc.com (10.1.113.115) by qlc.com (10.1.4.192) with Microsoft SMTP Server id 14.3.235.1; Sun, 26 Feb 2017 23:52:21 -0800 Received: (from rmody@localhost) by avluser05.qlc.com (8.14.4/8.14.4/Submit) id v1R7qLEg009729; Sun, 26 Feb 2017 23:52:21 -0800 X-Authentication-Warning: avluser05.qlc.com: rmody set sender to rasesh.mody@cavium.com using -f From: Rasesh Mody To: CC: Rasesh Mody , Date: Sun, 26 Feb 2017 23:51:55 -0800 Message-ID: <1488181923-9649-13-git-send-email-rasesh.mody@cavium.com> X-Mailer: git-send-email 1.7.10.3 In-Reply-To: <1488181923-9649-1-git-send-email-rasesh.mody@cavium.com> References: <1488181923-9649-1-git-send-email-rasesh.mody@cavium.com> MIME-Version: 1.0 Content-Type: text/plain disclaimer: bypass X-Proofpoint-Virus-Version: vendor=nai engine=5800 definitions=8451 signatures=669242 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1702020001 definitions=main-1702270079 Subject: [dpdk-dev] [PATCH 13/21] net/qede/base: fix out-of-bound memory access X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Feb 2017 07:52:24 -0000 Fix out-of-bound memory access on Management FW interaction for resource allocation Signed-off-by: Rasesh Mody --- drivers/net/qede/base/ecore_mcp.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/net/qede/base/ecore_mcp.c b/drivers/net/qede/base/ecore_mcp.c index 68cc10e..64069be 100644 --- a/drivers/net/qede/base/ecore_mcp.c +++ b/drivers/net/qede/base/ecore_mcp.c @@ -2427,15 +2427,15 @@ enum _ecore_status_t ecore_mcp_get_resc_info(struct ecore_hwfn *p_hwfn, u32 *p_mcp_resp, u32 *p_mcp_param) { struct ecore_mcp_mb_params mb_params; - union drv_union_data *p_union_data; + union drv_union_data union_data; enum _ecore_status_t rc; OSAL_MEM_ZERO(&mb_params, sizeof(mb_params)); mb_params.cmd = DRV_MSG_GET_RESOURCE_ALLOC_MSG; mb_params.param = ECORE_RESC_ALLOC_VERSION; - p_union_data = (union drv_union_data *)p_resc_info; - mb_params.p_data_src = p_union_data; - mb_params.p_data_dst = p_union_data; + OSAL_MEMCPY(&union_data.resource, p_resc_info, sizeof(*p_resc_info)); + mb_params.p_data_src = &union_data; + mb_params.p_data_dst = &union_data; rc = ecore_mcp_cmd_and_union(p_hwfn, p_ptt, &mb_params); if (rc != ECORE_SUCCESS) return rc; @@ -2443,6 +2443,8 @@ enum _ecore_status_t ecore_mcp_get_resc_info(struct ecore_hwfn *p_hwfn, *p_mcp_resp = mb_params.mcp_resp; *p_mcp_param = mb_params.mcp_param; + OSAL_MEMCPY(p_resc_info, &union_data.resource, sizeof(*p_resc_info)); + DP_VERBOSE(p_hwfn, ECORE_MSG_SP, "MFW resource_info: version 0x%x, res_id 0x%x, size 0x%x," " offset 0x%x, vf_size 0x%x, vf_offset 0x%x, flags 0x%x\n", -- 1.7.10.3