iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net/mlx5: Fix flow counter bulk command out mailbox allocation

Browse Source 
The FW command output length should be only the length of struct
mlx5_cmd_fc_bulk out field. Failing to do so will cause the memcpy
call which is invoked later in the driver to write over wrong memory
address and corrupt kernel memory which results in random crashes.

This bug was found using the kernel address sanitizer (kasan).

Fixes: a351a1b03bf1 ('net/mlx5: Introduce bulk reading of flow counters')
Signed-off-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Roi Dayan 2016-09-18 18:20:27 +03:00 committed by David S. Miller
parent 7ac327318e
commit babd6134a5
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
View File

@ -425,11 +425,11 @@ struct mlx5_cmd_fc_bulk *
mlx5_cmd_fc_bulk_alloc(struct mlx5_core_dev *dev, u16 id, int num) mlx5_cmd_fc_bulk_alloc(struct mlx5_core_dev *dev, u16 id, int num)
{ {
struct mlx5_cmd_fc_bulk *b; struct mlx5_cmd_fc_bulk *b;
int outlen = sizeof(*b) + int outlen =
MLX5_ST_SZ_BYTES(query_flow_counter_out) + MLX5_ST_SZ_BYTES(query_flow_counter_out) +
MLX5_ST_SZ_BYTES(traffic_counter) * num; MLX5_ST_SZ_BYTES(traffic_counter) * num;
b = kzalloc(outlen, GFP_KERNEL); b = kzalloc(sizeof(*b) + outlen, GFP_KERNEL);
if (!b) if (!b)
return NULL; return NULL;