> > Commit fe56b9e6a8d95 ("qed: Add module with basic common support")
> > has introduced a stack corruption during probe, where filling a
> > local struct with data to be sent to management firmware is incorrectly
> > filled; The data is written outside of the struct and corrupts
> > the stack.
> > 
> > @@ -1153,8 +1153,8 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
> >        p_drv_version = &union_data.drv_version;
> >        p_drv_version->version = p_ver->version;
> > 
> > -     for (i = 0; i < MCP_DRV_VER_STR_SIZE - 1; i += 4) {
> > -             val = cpu_to_be32(p_ver->name[i]);
> > +     for (i = 0; i < (MCP_DRV_VER_STR_SIZE - 4) / sizeof(u32); i++) {
> > +             val = cpu_to_be32(*((u32 *)&p_ver->name[i * sizeof(u32)]));
> >                *(__be32 *)&p_drv_version->name[i * sizeof(u32)] = val;
> >        }
> 
> Or the much simpler:
>      /* Byteswap driver name */
>         for (i = 0; i < MCP_DRV_VER_STR_SIZE; i++)
>                 p_drv_version->name[i ^ 3] = p_ver->name[i];

You're suggesting an unconditional swap; This will break
the message on a big endian machine [we'll swap needlessly].
    

Reply via email to