Date: Sat, 08 Aug 2026 00:38:22 +0000 From: Kevin Bowling <kbowling@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: b6bff124973e - stable/15 - ixgbe: fix unaligned access in ixgbe_update_flash_X550() Message-ID: <6a767a7e.3f229.5005d7ea@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by kbowling: URL: https://cgit.FreeBSD.org/src/commit/?id=b6bff124973e231237ed8c4df6144b7cb3a81d33 commit b6bff124973e231237ed8c4df6144b7cb3a81d33 Author: Kevin Bowling <kbowling@FreeBSD.org> AuthorDate: 2026-07-28 11:09:39 +0000 Commit: Kevin Bowling <kbowling@FreeBSD.org> CommitDate: 2026-08-08 00:35:52 +0000 ixgbe: fix unaligned access in ixgbe_update_flash_X550() ixgbe_host_interface_command() treats its buffer as a u32 array. The local union contained only byte-sized fields, giving it one-byte stack alignment and allowing unaligned accesses on strict-align systems. Add a u32 member to the union to provide the required alignment and pass that member to ixgbe_host_interface_command(). No functional change is expected on x86. Obtained from: Intel ix 3.4.39 (cherry picked from commit 8fa2a7503468abb5f863729c4e244d738239503d) --- sys/dev/ixgbe/ixgbe_type.h | 1 + sys/dev/ixgbe/ixgbe_x550.c | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sys/dev/ixgbe/ixgbe_type.h b/sys/dev/ixgbe/ixgbe_type.h index 4e242b7189cb..80f8effca6d5 100644 --- a/sys/dev/ixgbe/ixgbe_type.h +++ b/sys/dev/ixgbe/ixgbe_type.h @@ -3273,6 +3273,7 @@ struct ixgbe_hic_hdr2_rsp { }; union ixgbe_hic_hdr2 { + u32 buf[1]; struct ixgbe_hic_hdr2_req req; struct ixgbe_hic_hdr2_rsp rsp; }; diff --git a/sys/dev/ixgbe/ixgbe_x550.c b/sys/dev/ixgbe/ixgbe_x550.c index 7f07190f832c..f6ce0d10b9e2 100644 --- a/sys/dev/ixgbe/ixgbe_x550.c +++ b/sys/dev/ixgbe/ixgbe_x550.c @@ -3557,8 +3557,7 @@ s32 ixgbe_update_flash_X550(struct ixgbe_hw *hw) buffer.req.buf_lenl = FW_SHADOW_RAM_DUMP_LEN; buffer.req.checksum = FW_DEFAULT_CHECKSUM; - status = ixgbe_host_interface_command(hw, (u32 *)&buffer, - sizeof(buffer), + status = ixgbe_host_interface_command(hw, buffer.buf, sizeof(buffer), IXGBE_HI_COMMAND_TIMEOUT, false); return status;home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a767a7e.3f229.5005d7ea>