common/sfc_efx/base: limit reported MCDI response length
authorAndy Moreton <amoreton@xilinx.com>
Tue, 18 May 2021 15:10:11 +0000 (18:10 +0300)
committerFerruh Yigit <ferruh.yigit@intel.com>
Wed, 19 May 2021 09:32:49 +0000 (11:32 +0200)
commite1c9fcab3f17b050793d1e771d33448027a15ae1
tree7260c0937c0cf39cd4f54b11d3bca034059688c5
parente44ec39ca2c7c19632eca90841e57d7f636bd5c3
common/sfc_efx/base: limit reported MCDI response length

MCDI helper routines in libefx include length checks for response
messages, to ensure that short replies and optional fields are
handled correctly.

If the MCDI response message from the firmware is larger than the
caller's buffer then the response length reported to the caller
should be limited to the buffer size. Otherwise length checks in
the caller may allow reading past the end of the buffer.

Fixes: 6f619653b9b1 ("net/sfc/base: import MCDI implementation")
Cc: stable@dpdk.org
Signed-off-by: Andy Moreton <amoreton@xilinx.com>
Signed-off-by: Ivan Malov <ivan.malov@oktetlabs.ru>
Reviewed-by: Andrew Rybchenko <andrew.rybchenko@oktetlabs.ru>
drivers/common/sfc_efx/base/efx_mcdi.c