[PATCH v3 11/14] common/sfc_efx/base: fix flex array in netport stat describe
From: Ivan Malov <hidden>
Date: 2026-08-14 12:55:59
Subsystem:
the rest · Maintainer:
Linus Torvalds
From: Andy Moreton <redacted>
Code analysis reported returning uninitialised memory at *lut and
*nprocessedp. Refactor to ensure these parameters are only used
when non-NULL.
This function should also be using the ENTRY_COUNT field for the
number of descriptors returned, as the descriptor size is not
known statically (they are extensible). Also use the MORE_ENTRIES
flag to determine if all of the descriptors have been fetched.
Fixes: f2f77453cb9f ("common/sfc_efx/base: fill in software LUT for MAC statistics")
Cc: stable@dpdk.org
Signed-off-by: Andy Moreton <redacted>
Reviewed-by: Ivan Malov <redacted>
Reviewed-by: Viacheslav Galaktionov <redacted>
---
drivers/common/sfc_efx/base/efx_np.c | 39 +++++++++++++++++++---------
1 file changed, 27 insertions(+), 12 deletions(-)
diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index e7ca6d3302..ec76985054 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c@@ -782,10 +782,11 @@ efx_np_stats_describe( __out_opt uint32_t *nstats_maxp) { uint8_t *payload = NULL; - uint32_t nprocessed; efx_mcdi_req_t req; uint8_t *entries; uint32_t stride; + uint32_t count; + uint32_t more; unsigned int i; size_t out_sz; size_t size;
@@ -828,29 +829,43 @@ efx_np_stats_describe( sizeof (efx_qword_t); } - if (lut_nentries == 0 || lut == NULL || nprocessedp == NULL) - goto out; - stride = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_SIZE); - nprocessed = MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES_NUM(out_sz); - if (nprocessed == 0) { + count = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_COUNT); + more = MCDI_OUT_DWORD_FIELD(req, + MAC_STATISTICS_DESCRIPTOR_OUT_FLAGS, + MAC_STATISTICS_DESCRIPTOR_OUT_MORE_ENTRIES); + + if ((count == 0) && (more != 0)) { rc = EMSGSIZE; goto fail4; } - entries = MCDI_OUT2(req, uint8_t, - MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES); + if (count > 0 && (stride < MC_CMD_STAT_DESC_LEN || count > + (out_sz - MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES_OFST) / + stride)) { + rc = EMSGSIZE; + goto fail5; + } + + if (lut != NULL) { + entries = MCDI_OUT2(req, uint8_t, + MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES); - for (i = 0; i < nprocessed; ++i) - efx_np_stat_describe(entries + i * stride, lut_nentries, lut); + for (i = 0; i < count; ++i) { + efx_np_stat_describe(entries + i * stride, + lut_nentries, lut); + } + } - *nprocessedp = nprocessed; + if (nprocessedp != NULL) + *nprocessedp = count; -out: EFSYS_KMEM_FREE(enp->en_esip, size, payload); return (0); +fail5: + EFSYS_PROBE(fail5); fail4: EFSYS_PROBE(fail4); fail3:
--
2.47.3