In tfc_msg_tcam_alloc_set(), the key, mask and remap are copied into
the HWRM request with memcpy() using the address of the local
pointer variables (&key, &mask, &remap) as the source instead of the
data they point to. The copy lengths are also computed as
size * sizeof(uint32_t), although key_size and remap_size are
already byte counts, so each copy is four times too long and can run
past the 2 * key_size + remap_size bytes reserved in the request.
Copy from the key, mask and remap buffers themselves, and use the
byte sizes directly.
Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
Cc: [email protected]
Signed-off-by: Manish Kurup <[email protected]>
---
v2:
* Split out of "net/bnxt: fix multiple truflow defects" (one fix per
patch); this is the tfc_msg_tcam_alloc_set() fix.
* New subject and commit message; single Fixes: tag.
drivers/net/bnxt/tf_core/v3/tfc_msg.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/bnxt/tf_core/v3/tfc_msg.c
b/drivers/net/bnxt/tf_core/v3/tfc_msg.c
index 89c256b810..af74007747 100644
--- a/drivers/net/bnxt/tf_core/v3/tfc_msg.c
+++ b/drivers/net/bnxt/tf_core/v3/tfc_msg.c
@@ -1088,9 +1088,9 @@ tfc_msg_tcam_alloc_set(struct tfc *tfcp, uint16_t fid,
uint16_t sid,
data = &req.dev_data[0];
}
- memcpy(&data[0], &key, key_size * sizeof(uint32_t));
- memcpy(&data[key_size], &mask, key_size * sizeof(uint32_t));
- memcpy(&data[key_size * 2], &remap, remap_size * sizeof(uint32_t));
+ memcpy(&data[0], key, key_size);
+ memcpy(&data[key_size], mask, key_size);
+ memcpy(&data[key_size * 2], remap, remap_size);
rc = bnxt_hwrm_tf_message_direct(bp, false, HWRM_TFC_TCAM_ALLOC_SET,
&req, sizeof(req), &resp,
sizeof(resp));
--
2.31.1
