summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorRoi Dayan <roid@mellanox.com>2016-09-18 18:20:27 +0300
committerDavid S. Miller <davem@davemloft.net>2016-09-19 22:10:15 -0400
commitbabd6134a54d70efe875fa5661a20eaecb63f278 (patch)
tree78c9c6ed58345d58c73e94b63c266f83507c26ba /drivers
parent7ac327318e09a53e3df431dfd3f664dac7aba4df (diff)
downloadlinux-babd6134a54d70efe875fa5661a20eaecb63f278.tar.bz2
net/mlx5: Fix flow counter bulk command out mailbox allocation
The FW command output length should be only the length of struct mlx5_cmd_fc_bulk out field. Failing to do so will cause the memcpy call which is invoked later in the driver to write over wrong memory address and corrupt kernel memory which results in random crashes. This bug was found using the kernel address sanitizer (kasan). Fixes: a351a1b03bf1 ('net/mlx5: Introduce bulk reading of flow counters') Signed-off-by: Roi Dayan <roid@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index 9134010e2921..287ade151ec8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -425,11 +425,11 @@ struct mlx5_cmd_fc_bulk *
mlx5_cmd_fc_bulk_alloc(struct mlx5_core_dev *dev, u16 id, int num)
{
struct mlx5_cmd_fc_bulk *b;
- int outlen = sizeof(*b) +
+ int outlen =
MLX5_ST_SZ_BYTES(query_flow_counter_out) +
MLX5_ST_SZ_BYTES(traffic_counter) * num;
- b = kzalloc(outlen, GFP_KERNEL);
+ b = kzalloc(sizeof(*b) + outlen, GFP_KERNEL);
if (!b)
return NULL;