From: Dakota Sicher <[email protected]>
ulp_mapper_blob_block_swap() used a variable-length array on the
stack sized by caller input for swap memory. Use a heap allocation
instead to avoid unbounded stack growth.
Fixes: dd0191d5e70d ("net/bnxt/tf_ulp: support Thor2 ULP layer")
Cc: [email protected]
Signed-off-by: Dakota Sicher <[email protected]>
Signed-off-by: Manish Kurup <[email protected]>
---
drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
b/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
index 2d89f10d5e..934634c606 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
@@ -388,9 +388,8 @@ static const char * const mpc_error_str[] = {
static int32_t
ulp_mapper_blob_block_swap(struct ulp_blob *blob, uint32_t block_sz)
{
- uint8_t data[block_sz]; /* size of a block for temp storage */
uint16_t num_words, data_sz;
- uint8_t *pdata;
+ uint8_t *pdata, *data;
int i;
/* Shouldn't happen since it is internal function, but check anyway */
@@ -407,6 +406,12 @@ ulp_mapper_blob_block_swap(struct ulp_blob *blob, uint32_t
block_sz)
return -EINVAL;
}
+ data = rte_zmalloc(NULL, block_sz, 0);
+ if (unlikely(!data)) {
+ BNXT_DRV_DBG(ERR, "Failed to allocate swap buffer");
+ return -ENOMEM;
+ }
+
num_words = data_sz / block_sz;
for (i = 0; i < num_words / 2; i++) {
memcpy(data, &pdata[i * block_sz], block_sz);
@@ -415,6 +420,7 @@ ulp_mapper_blob_block_swap(struct ulp_blob *blob, uint32_t
block_sz)
memcpy(&pdata[(num_words - 1 - i) * block_sz],
data, block_sz);
}
+ rte_free(data);
return 0;
}
--
2.31.1
