From: Pavel Belous Date: Tue, 12 Mar 2019 15:24:57 +0000 (+0000) Subject: net/atlantic: fix buffer overflow X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=e09a7bee7772d39e57537a7564c9d58ed028ffcf;p=dpdk.git net/atlantic: fix buffer overflow Found by Coverity scan. This is a real memory corruption. There is no need in extra RTE_ALIGN macros since the request/result structures are 4-byte aligned by definition. Coverity issue: 323518, 323520 Fixes: ce4e8d418097 ("net/atlantic: implement EEPROM get/set") Cc: stable@dpdk.org Signed-off-by: Igor Russkikh Signed-off-by: Pavel Belous --- diff --git a/drivers/net/atlantic/hw_atl/hw_atl_utils_fw2x.c b/drivers/net/atlantic/hw_atl/hw_atl_utils_fw2x.c index 6841d9bce3..f90ccfe9e0 100644 --- a/drivers/net/atlantic/hw_atl/hw_atl_utils_fw2x.c +++ b/drivers/net/atlantic/hw_atl/hw_atl_utils_fw2x.c @@ -501,7 +501,7 @@ static int aq_fw2x_get_eeprom(struct aq_hw_s *self, u32 *data, u32 len) /* Write SMBUS request to cfg memory */ err = hw_atl_utils_fw_upload_dwords(self, self->rpc_addr, (u32 *)(void *)&request, - RTE_ALIGN(sizeof(request), sizeof(u32))); + sizeof(request) / sizeof(u32)); if (err < 0) return err; @@ -523,7 +523,7 @@ static int aq_fw2x_get_eeprom(struct aq_hw_s *self, u32 *data, u32 len) err = hw_atl_utils_fw_downld_dwords(self, self->rpc_addr + sizeof(u32), &result, - RTE_ALIGN(sizeof(result), sizeof(u32))); + sizeof(result) / sizeof(u32)); if (err < 0) return err; @@ -558,7 +558,7 @@ static int aq_fw2x_set_eeprom(struct aq_hw_s *self, u32 *data, u32 len) /* Write SMBUS request to cfg memory */ err = hw_atl_utils_fw_upload_dwords(self, self->rpc_addr, (u32 *)(void *)&request, - RTE_ALIGN(sizeof(request), sizeof(u32))); + sizeof(request) / sizeof(u32)); if (err < 0) return err; @@ -589,7 +589,7 @@ static int aq_fw2x_set_eeprom(struct aq_hw_s *self, u32 *data, u32 len) /* Read status of write operation */ err = hw_atl_utils_fw_downld_dwords(self, self->rpc_addr + sizeof(u32), &result, - RTE_ALIGN(sizeof(result), sizeof(u32))); + sizeof(result) / sizeof(u32)); if (err < 0) return err;