net/sfc/base: fix out of bounds read when dereferencing sdup

[dpdk.git] / drivers / net / sfc / base / ef10_mac.c

diff --git a/drivers/net/sfc/base/ef10_mac.c b/drivers/net/sfc/base/ef10_mac.c
index df2c0fb..a4a6d9e 100644 (file)
--- a/drivers/net/sfc/base/ef10_mac.c
+++ b/drivers/net/sfc/base/ef10_mac.c
@@ -75,11 +75,10 @@ efx_mcdi_vadapter_set_mac(
 {
        efx_port_t *epp = &(enp->en_port);
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_VADAPTOR_SET_MAC_IN_LEN,
-                           MC_CMD_VADAPTOR_SET_MAC_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_VADAPTOR_SET_MAC_IN_LEN,
+               MC_CMD_VADAPTOR_SET_MAC_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_VADAPTOR_SET_MAC;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_VADAPTOR_SET_MAC_IN_LEN;
@@ -141,11 +140,10 @@ efx_mcdi_mtu_set(
        __in            uint32_t mtu)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_SET_MAC_EXT_IN_LEN,
-                           MC_CMD_SET_MAC_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_MAC_EXT_IN_LEN,
+               MC_CMD_SET_MAC_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_SET_MAC;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_SET_MAC_EXT_IN_LEN;
@@ -178,11 +176,10 @@ efx_mcdi_mtu_get(
        __out           size_t *mtu)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_SET_MAC_EXT_IN_LEN,
-                           MC_CMD_SET_MAC_V2_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_MAC_EXT_IN_LEN,
+               MC_CMD_SET_MAC_V2_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_SET_MAC;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_SET_MAC_EXT_IN_LEN;
@@ -274,11 +271,10 @@ ef10_mac_reconfigure(
 {
        efx_port_t *epp = &(enp->en_port);
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_SET_MAC_IN_LEN,
-                           MC_CMD_SET_MAC_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_SET_MAC_IN_LEN,
+               MC_CMD_SET_MAC_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_SET_MAC;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_SET_MAC_IN_LEN;
@@ -412,7 +408,7 @@ ef10_mac_filter_default_rxq_clear(
 
        ef10_filter_default_rxq_clear(enp);
 
-       efx_filter_reconfigure(enp, epp->ep_mac_addr,
+       (void) efx_filter_reconfigure(enp, epp->ep_mac_addr,
                                    epp->ep_all_unicst, epp->ep_mulcst,
                                    epp->ep_all_mulcst, epp->ep_brdcst,
                                    epp->ep_mulcst_addr_list,
@@ -526,15 +522,39 @@ ef10_mac_stats_get_mask(
        if (encp->enc_fec_counters) {
                const struct efx_mac_stats_range ef10_fec[] = {
                        { EFX_MAC_FEC_UNCORRECTED_ERRORS,
-                           MC_CMD_MAC_FEC_CORRECTED_SYMBOLS_LANE3 },
+                           EFX_MAC_FEC_CORRECTED_SYMBOLS_LANE3 },
                };
                if ((rc = efx_mac_stats_mask_add_ranges(maskp, mask_size,
                    ef10_fec, EFX_ARRAY_SIZE(ef10_fec))) != 0)
                        goto fail7;
        }
 
+       if (encp->enc_mac_stats_nstats >= MC_CMD_MAC_NSTATS_V4) {
+               const struct efx_mac_stats_range ef10_rxdp_sdt[] = {
+                       { EFX_MAC_RXDP_SCATTER_DISABLED_TRUNC,
+                           EFX_MAC_RXDP_SCATTER_DISABLED_TRUNC },
+               };
+
+               if ((rc = efx_mac_stats_mask_add_ranges(maskp, mask_size,
+                   ef10_rxdp_sdt, EFX_ARRAY_SIZE(ef10_rxdp_sdt))) != 0)
+                       goto fail8;
+       }
+
+       if (encp->enc_hlb_counters) {
+               const struct efx_mac_stats_range ef10_hlb[] = {
+                       { EFX_MAC_RXDP_HLB_IDLE, EFX_MAC_RXDP_HLB_TIMEOUT },
+               };
+               if ((rc = efx_mac_stats_mask_add_ranges(maskp, mask_size,
+                   ef10_hlb, EFX_ARRAY_SIZE(ef10_hlb))) != 0)
+                       goto fail9;
+       }
+
        return (0);
 
+fail9:
+       EFSYS_PROBE(fail9);
+fail8:
+       EFSYS_PROBE(fail8);
 fail7:
        EFSYS_PROBE(fail7);
 fail6:
@@ -978,6 +998,21 @@ ef10_mac_stats_update(
        EF10_MAC_STAT_READ(esmp, MC_CMD_MAC_CTPIO_ERASE, &value);
        EFSYS_STAT_SET_QWORD(&(stat[EFX_MAC_CTPIO_ERASE]), &value);
 
+       if (encp->enc_mac_stats_nstats < MC_CMD_MAC_NSTATS_V4)
+               goto done;
+
+       EF10_MAC_STAT_READ(esmp, MC_CMD_MAC_RXDP_SCATTER_DISABLED_TRUNC,
+           &value);
+       EFSYS_STAT_SET_QWORD(&(stat[EFX_MAC_RXDP_SCATTER_DISABLED_TRUNC]),
+           &value);
+
+       /* Head-of-line blocking */
+       EF10_MAC_STAT_READ(esmp, MC_CMD_MAC_RXDP_HLB_IDLE, &value);
+       EFSYS_STAT_SET_QWORD(&(stat[EFX_MAC_RXDP_HLB_IDLE]), &value);
+
+       EF10_MAC_STAT_READ(esmp, MC_CMD_MAC_RXDP_HLB_TIMEOUT, &value);
+       EFSYS_STAT_SET_QWORD(&(stat[EFX_MAC_RXDP_HLB_TIMEOUT]), &value);
+
 done:
        /* Read START generation counter */
        EFSYS_DMA_SYNC_FOR_KERNEL(esmp, 0, EFSYS_MEM_SIZE(esmp));