From c4a7c3af32d1d7ae8e647bff6fbf8fc6695c1632 Mon Sep 17 00:00:00 2001 From: arybchik Date: Wed, 26 Dec 2018 10:22:49 +0000 Subject: [PATCH] MFC r341290 sfxge(4): check size of memory to read sensors data to Size of provided memory should be consistent with specified size. Submitted by: Martin Harvey Sponsored by: Solarflare Communications, Inc. Differential Revision: https://reviews.freebsd.org/D18252 git-svn-id: svn://svn.freebsd.org/base/stable/10@342514 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- sys/dev/sfxge/common/mcdi_mon.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/sys/dev/sfxge/common/mcdi_mon.c b/sys/dev/sfxge/common/mcdi_mon.c index 2b24b08fe..dde25b631 100644 --- a/sys/dev/sfxge/common/mcdi_mon.c +++ b/sys/dev/sfxge/common/mcdi_mon.c @@ -322,6 +322,12 @@ efx_mcdi_read_sensors( uint8_t payload[MAX(MC_CMD_READ_SENSORS_EXT_IN_LEN, MC_CMD_READ_SENSORS_EXT_OUT_LEN)]; uint32_t addr_lo, addr_hi; + efx_rc_t rc; + + if (EFSYS_MEM_SIZE(esmp) < size) { + rc = EINVAL; + goto fail1; + } req.emr_cmd = MC_CMD_READ_SENSORS; req.emr_in_buf = payload; @@ -339,6 +345,11 @@ efx_mcdi_read_sensors( efx_mcdi_execute(enp, &req); return (req.emr_rc); + +fail1: + EFSYS_PROBE1(fail1, efx_rc_t, rc); + + return (rc); } static __checkReturn efx_rc_t -- 2.45.0