net/mlx5: Fix flow counter bulk command out mailbox allocation
authorRoi Dayan <roid@mellanox.com>
Sun, 18 Sep 2016 15:20:27 +0000 (18:20 +0300)
committerDavid S. Miller <davem@davemloft.net>
Tue, 20 Sep 2016 02:10:15 +0000 (22:10 -0400)
commitbabd6134a54d70efe875fa5661a20eaecb63f278
tree78c9c6ed58345d58c73e94b63c266f83507c26ba
parent7ac327318e09a53e3df431dfd3f664dac7aba4df
net/mlx5: Fix flow counter bulk command out mailbox allocation

The FW command output length should be only the length of struct
mlx5_cmd_fc_bulk out field. Failing to do so will cause the memcpy
call which is invoked later in the driver to write over wrong memory
address and corrupt kernel memory which results in random crashes.

This bug was found using the kernel address sanitizer (kasan).

Fixes: a351a1b03bf1 ('net/mlx5: Introduce bulk reading of flow counters')
Signed-off-by: Roi Dayan <roid@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c