net/sfc/base: fix out of bounds read when dereferencing sdup

[dpdk.git] / drivers / net / sfc / base / efx_mcdi.c

diff --git a/drivers/net/sfc/base/efx_mcdi.c b/drivers/net/sfc/base/efx_mcdi.c
index d4ebcf2..84d8452 100644 (file)
--- a/drivers/net/sfc/base/efx_mcdi.c
+++ b/drivers/net/sfc/base/efx_mcdi.c
@@ -900,10 +900,10 @@ efx_mcdi_version(
        __out_opt               efx_mcdi_boot_t *statusp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MAX(MC_CMD_GET_VERSION_IN_LEN,
-                               MC_CMD_GET_VERSION_OUT_LEN),
-                           MAX(MC_CMD_GET_BOOT_STATUS_IN_LEN,
-                               MC_CMD_GET_BOOT_STATUS_OUT_LEN))];
+       EFX_MCDI_DECLARE_BUF(payload,
+               MAX(MC_CMD_GET_VERSION_IN_LEN, MC_CMD_GET_BOOT_STATUS_IN_LEN),
+               MAX(MC_CMD_GET_VERSION_OUT_LEN,
+                       MC_CMD_GET_BOOT_STATUS_OUT_LEN));
        efx_word_t *ver_words;
        uint16_t version[4];
        uint32_t build;
@@ -912,7 +912,6 @@ efx_mcdi_version(
 
        EFSYS_ASSERT3U(enp->en_features, &, EFX_FEATURE_MCDI);
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_GET_VERSION;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_GET_VERSION_IN_LEN;
@@ -1018,12 +1017,11 @@ efx_mcdi_get_capabilities(
        __out_opt       uint32_t *tso2ncp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_GET_CAPABILITIES_IN_LEN,
-                           MC_CMD_GET_CAPABILITIES_V2_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_CAPABILITIES_IN_LEN,
+               MC_CMD_GET_CAPABILITIES_V2_OUT_LEN);
        boolean_t v2_capable;
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_GET_CAPABILITIES;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_GET_CAPABILITIES_IN_LEN;
@@ -1086,7 +1084,8 @@ efx_mcdi_do_reboot(
        __in            efx_nic_t *enp,
        __in            boolean_t after_assertion)
 {
-       uint8_t payload[MAX(MC_CMD_REBOOT_IN_LEN, MC_CMD_REBOOT_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_REBOOT_IN_LEN,
+               MC_CMD_REBOOT_OUT_LEN);
        efx_mcdi_req_t req;
        efx_rc_t rc;
 
@@ -1099,7 +1098,6 @@ efx_mcdi_do_reboot(
         */
        EFSYS_ASSERT3U(enp->en_magic, ==, EFX_NIC_MAGIC);
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_REBOOT;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_REBOOT_IN_LEN;
@@ -1150,8 +1148,8 @@ efx_mcdi_read_assertion(
        __in            efx_nic_t *enp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_GET_ASSERTS_IN_LEN,
-                           MC_CMD_GET_ASSERTS_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_ASSERTS_IN_LEN,
+               MC_CMD_GET_ASSERTS_OUT_LEN);
        const char *reason;
        unsigned int flags;
        unsigned int index;
@@ -1252,11 +1250,10 @@ efx_mcdi_drv_attach(
        __in            boolean_t attach)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_DRV_ATTACH_IN_LEN,
-                           MC_CMD_DRV_ATTACH_EXT_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_DRV_ATTACH_IN_LEN,
+               MC_CMD_DRV_ATTACH_EXT_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_DRV_ATTACH;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_DRV_ATTACH_IN_LEN;
@@ -1311,11 +1308,10 @@ efx_mcdi_get_board_cfg(
 {
        efx_mcdi_iface_t *emip = &(enp->en_mcdi.em_emip);
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_GET_BOARD_CFG_IN_LEN,
-                           MC_CMD_GET_BOARD_CFG_OUT_LENMIN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_BOARD_CFG_IN_LEN,
+               MC_CMD_GET_BOARD_CFG_OUT_LENMIN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_GET_BOARD_CFG;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_GET_BOARD_CFG_IN_LEN;
@@ -1391,11 +1387,10 @@ efx_mcdi_get_resource_limits(
        __out_opt       uint32_t *ntxqp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_GET_RESOURCE_LIMITS_IN_LEN,
-                           MC_CMD_GET_RESOURCE_LIMITS_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_RESOURCE_LIMITS_IN_LEN,
+               MC_CMD_GET_RESOURCE_LIMITS_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_GET_RESOURCE_LIMITS;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_GET_RESOURCE_LIMITS_IN_LEN;
@@ -1438,8 +1433,8 @@ efx_mcdi_get_phy_cfg(
        efx_port_t *epp = &(enp->en_port);
        efx_nic_cfg_t *encp = &(enp->en_nic_cfg);
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_GET_PHY_CFG_IN_LEN,
-                           MC_CMD_GET_PHY_CFG_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PHY_CFG_IN_LEN,
+               MC_CMD_GET_PHY_CFG_OUT_LEN);
 #if EFSYS_OPT_NAMES
        const char *namep;
        size_t namelen;
@@ -1447,7 +1442,6 @@ efx_mcdi_get_phy_cfg(
        uint32_t phy_media_type;
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_GET_PHY_CFG;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_GET_PHY_CFG_IN_LEN;
@@ -1686,11 +1680,10 @@ efx_mcdi_bist_start(
        __in                    efx_bist_type_t type)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_START_BIST_IN_LEN,
-                           MC_CMD_START_BIST_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_START_BIST_IN_LEN,
+               MC_CMD_START_BIST_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_START_BIST;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_START_BIST_IN_LEN;
@@ -1749,11 +1742,10 @@ efx_mcdi_log_ctrl(
        __in            efx_nic_t *enp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_LOG_CTRL_IN_LEN,
-                           MC_CMD_LOG_CTRL_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_LOG_CTRL_IN_LEN,
+               MC_CMD_LOG_CTRL_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_LOG_CTRL;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_LOG_CTRL_IN_LEN;
@@ -1798,8 +1790,8 @@ efx_mcdi_mac_stats(
        __in            uint16_t period_ms)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_MAC_STATS_IN_LEN,
-                           MC_CMD_MAC_STATS_V2_OUT_DMA_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_MAC_STATS_IN_LEN,
+               MC_CMD_MAC_STATS_V2_OUT_DMA_LEN);
        int clear = (action == EFX_STATS_CLEAR);
        int upload = (action == EFX_STATS_UPLOAD);
        int enable = (action == EFX_STATS_ENABLE_NOEVENTS);
@@ -1807,7 +1799,6 @@ efx_mcdi_mac_stats(
        int disable = (action == EFX_STATS_DISABLE);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_MAC_STATS;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_MAC_STATS_IN_LEN;
@@ -1979,11 +1970,10 @@ efx_mcdi_get_function_info(
        __out_opt               uint32_t *vfp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_GET_FUNCTION_INFO_IN_LEN,
-                           MC_CMD_GET_FUNCTION_INFO_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_FUNCTION_INFO_IN_LEN,
+               MC_CMD_GET_FUNCTION_INFO_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_GET_FUNCTION_INFO;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_GET_FUNCTION_INFO_IN_LEN;
@@ -2024,11 +2014,10 @@ efx_mcdi_privilege_mask(
        __out                   uint32_t *maskp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_PRIVILEGE_MASK_IN_LEN,
-                           MC_CMD_PRIVILEGE_MASK_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_PRIVILEGE_MASK_IN_LEN,
+               MC_CMD_PRIVILEGE_MASK_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_PRIVILEGE_MASK;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_PRIVILEGE_MASK_IN_LEN;
@@ -2073,11 +2062,10 @@ efx_mcdi_set_workaround(
        __out_opt               uint32_t *flagsp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_WORKAROUND_IN_LEN,
-                           MC_CMD_WORKAROUND_EXT_OUT_LEN)];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_WORKAROUND_IN_LEN,
+               MC_CMD_WORKAROUND_EXT_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_WORKAROUND;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_WORKAROUND_IN_LEN;
@@ -2117,10 +2105,9 @@ efx_mcdi_get_workarounds(
        __out_opt               uint32_t *enabledp)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MC_CMD_GET_WORKAROUNDS_OUT_LEN];
+       EFX_MCDI_DECLARE_BUF(payload, 0, MC_CMD_GET_WORKAROUNDS_OUT_LEN);
        efx_rc_t rc;
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_GET_WORKAROUNDS;
        req.emr_in_buf = NULL;
        req.emr_in_length = 0;
@@ -2166,14 +2153,13 @@ efx_mcdi_get_phy_media_info(
        __out_bcount(len)       uint8_t *data)
 {
        efx_mcdi_req_t req;
-       uint8_t payload[MAX(MC_CMD_GET_PHY_MEDIA_INFO_IN_LEN,
-                           MC_CMD_GET_PHY_MEDIA_INFO_OUT_LEN(
-                               EFX_PHY_MEDIA_INFO_PAGE_SIZE))];
+       EFX_MCDI_DECLARE_BUF(payload, MC_CMD_GET_PHY_MEDIA_INFO_IN_LEN,
+               MC_CMD_GET_PHY_MEDIA_INFO_OUT_LEN(
+                       EFX_PHY_MEDIA_INFO_PAGE_SIZE));
        efx_rc_t rc;
 
        EFSYS_ASSERT((uint32_t)offset + len <= EFX_PHY_MEDIA_INFO_PAGE_SIZE);
 
-       (void) memset(payload, 0, sizeof (payload));
        req.emr_cmd = MC_CMD_GET_PHY_MEDIA_INFO;
        req.emr_in_buf = payload;
        req.emr_in_length = MC_CMD_GET_PHY_MEDIA_INFO_IN_LEN;