Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 25 Dec 2018 07:23:05 +0000 (UTC)
From:      Andrew Rybchenko <arybchik@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r342443 - stable/11/sys/dev/sfxge/common
Message-ID:  <201812250723.wBP7N5GB046279@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: arybchik
Date: Tue Dec 25 07:23:04 2018
New Revision: 342443
URL: https://svnweb.freebsd.org/changeset/base/342443

Log:
  MFC r341290
  
  sfxge(4): check size of memory to read sensors data to
  
  Size of provided memory should be consistent with specified size.
  
  Submitted by:   Martin Harvey <mharvey at solarflare.com>
  Sponsored by:   Solarflare Communications, Inc.
  Differential Revision:  https://reviews.freebsd.org/D18252

Modified:
  stable/11/sys/dev/sfxge/common/mcdi_mon.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/dev/sfxge/common/mcdi_mon.c
==============================================================================
--- stable/11/sys/dev/sfxge/common/mcdi_mon.c	Tue Dec 25 07:22:24 2018	(r342442)
+++ stable/11/sys/dev/sfxge/common/mcdi_mon.c	Tue Dec 25 07:23:04 2018	(r342443)
@@ -322,7 +322,13 @@ efx_mcdi_read_sensors(
 	uint8_t payload[MAX(MC_CMD_READ_SENSORS_EXT_IN_LEN,
 			    MC_CMD_READ_SENSORS_EXT_OUT_LEN)];
 	uint32_t addr_lo, addr_hi;
+	efx_rc_t rc;
 
+	if (EFSYS_MEM_SIZE(esmp) < size) {
+		rc = EINVAL;
+		goto fail1;
+	}
+
 	req.emr_cmd = MC_CMD_READ_SENSORS;
 	req.emr_in_buf = payload;
 	req.emr_in_length = MC_CMD_READ_SENSORS_EXT_IN_LEN;
@@ -339,6 +345,11 @@ efx_mcdi_read_sensors(
 	efx_mcdi_execute(enp, &req);
 
 	return (req.emr_rc);
+
+fail1:
+	EFSYS_PROBE1(fail1, efx_rc_t, rc);
+
+	return (rc);
 }
 
 static	__checkReturn	efx_rc_t



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201812250723.wBP7N5GB046279>