From: Andy Moreton Date: Tue, 4 Apr 2017 12:13:27 +0000 (+0100) Subject: net/sfc/base: fix out of bounds read in VIs allocation X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=6e2ea132abcb9165f3aaaee93a1d0e0a7caf08f8;p=dpdk.git net/sfc/base: fix out of bounds read in VIs allocation Coverity issue: 1349662 Fixes: e7cd430c864f ("net/sfc/base: import SFN7xxx family support") Cc: stable@dpdk.org Signed-off-by: Andy Moreton Signed-off-by: Andrew Rybchenko --- diff --git a/drivers/net/sfc/base/ef10_nic.c b/drivers/net/sfc/base/ef10_nic.c index 3a743206a8..aac2679c32 100644 --- a/drivers/net/sfc/base/ef10_nic.c +++ b/drivers/net/sfc/base/ef10_nic.c @@ -501,7 +501,7 @@ efx_mcdi_alloc_vis( { efx_mcdi_req_t req; uint8_t payload[MAX(MC_CMD_ALLOC_VIS_IN_LEN, - MC_CMD_ALLOC_VIS_OUT_LEN)]; + MC_CMD_ALLOC_VIS_EXT_OUT_LEN)]; efx_rc_t rc; if (vi_countp == NULL) { @@ -514,7 +514,7 @@ efx_mcdi_alloc_vis( req.emr_in_buf = payload; req.emr_in_length = MC_CMD_ALLOC_VIS_IN_LEN; req.emr_out_buf = payload; - req.emr_out_length = MC_CMD_ALLOC_VIS_OUT_LEN; + req.emr_out_length = MC_CMD_ALLOC_VIS_EXT_OUT_LEN; MCDI_IN_SET_DWORD(req, ALLOC_VIS_IN_MIN_VI_COUNT, min_vi_count); MCDI_IN_SET_DWORD(req, ALLOC_VIS_IN_MAX_VI_COUNT, max_vi_count);