Re: [Intel-wired-lan] [PATCH iwl-next v3 1/3] ice: ice_aq_check_events: fix off-by-one check when filling buffer

[Przemek Kitszel <przemyslaw.kitszel@intel.com>]

On 8/8/23 20:06, Tony Nguyen wrote:
> 
> 
> On 8/7/2023 8:58 AM, Przemek Kitszel wrote:
>> Allow task's event buffer to be filled also in the case that it's size
>> is exactly the size of the message.
>>
>> Fixes: d69ea414c9b4 ("ice: implement device flash update via devlink")
>> Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
>> ---
>>   drivers/net/ethernet/intel/ice/ice_main.c | 14 ++++++++------
>>   1 file changed, 8 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/intel/ice/ice_main.c 
>> b/drivers/net/ethernet/intel/ice/ice_main.c
>> index a73895483e6c..f2ad2153589a 100644
>> --- a/drivers/net/ethernet/intel/ice/ice_main.c
>> +++ b/drivers/net/ethernet/intel/ice/ice_main.c
>> @@ -1357,7 +1357,9 @@ int ice_aq_wait_for_event(struct ice_pf *pf, u16 
>> opcode, unsigned long timeout,
>>   static void ice_aq_check_events(struct ice_pf *pf, u16 opcode,
>>                   struct ice_rq_event_info *event)
>>   {
>> +    struct ice_rq_event_info *task_ev;
>>       struct ice_aq_task *task;
>> +
> 
> Accidental newline?

Ouch, sorry :( and thank for catching it!

> 
>>       bool found = false;
>>       spin_lock_bh(&pf->aq_wait_lock);
>> @@ -1365,15 +1367,15 @@ static void ice_aq_check_events(struct ice_pf 
>> *pf, u16 opcode,
>>           if (task->state || task->opcode != opcode)
>>               continue;
>> -        memcpy(&task->event->desc, &event->desc, sizeof(event->desc));
>> -        task->event->msg_len = event->msg_len;
>> +        task_ev = task->event;
>> +        memcpy(&task_ev->desc, &event->desc, sizeof(event->desc));
>> +        task_ev->msg_len = event->msg_len;
>>           /* Only copy the data buffer if a destination was set */
>> -        if (task->event->msg_buf &&
>> -            task->event->buf_len > event->buf_len) {
>> -            memcpy(task->event->msg_buf, event->msg_buf,
>> +        if (task_ev->msg_buf && task_ev->buf_len >= event->buf_len) {
>> +            memcpy(task_ev->msg_buf, event->msg_buf,
>>                      event->buf_len);
>> -            task->event->buf_len = event->buf_len;
>> +            task_ev->buf_len = event->buf_len;
>>           }
>>           task->state = ICE_AQ_TASK_COMPLETE;

_______________________________________________
Intel-wired-lan mailing list
Intel-wired-lan@osuosl.org
https://lists.osuosl.org/mailman/listinfo/intel-wired-lan