Page Menu
Home
FreeBSD
Search
Configure Global Search
Log In
Files
F156844756
D23933.id69137.diff
No One
Temporary
Actions
View File
Edit File
Delete File
View Transforms
Subscribe
Mute Notifications
Flag For Later
Award Token
Size
3 KB
Referenced Files
None
Subscribers
None
D23933.id69137.diff
View Options
Index: sys/dev/bnxt/if_bnxt.c
===================================================================
--- sys/dev/bnxt/if_bnxt.c
+++ sys/dev/bnxt/if_bnxt.c
@@ -1650,25 +1650,23 @@
{
struct bnxt_softc *softc = iflib_get_softc(ctx);
struct ifreq *ifr = (struct ifreq *)data;
- struct ifreq_buffer *ifbuf = &ifr->ifr_ifru.ifru_buffer;
- struct bnxt_ioctl_header *ioh =
- (struct bnxt_ioctl_header *)(ifbuf->buffer);
+ struct bnxt_ioctl_header *ioh;
+ size_t iol;
int rc = ENOTSUP;
- struct bnxt_ioctl_data *iod = NULL;
+ struct bnxt_ioctl_data iod_storage, *iod = &iod_storage;
+
+ ioh = ifr_buffer_get_buffer(ifr);
+ iol = ifr_buffer_get_length(ifr);
switch (command) {
case SIOCGPRIVATE_0:
if ((rc = priv_check(curthread, PRIV_DRIVER)) != 0)
goto exit;
- iod = malloc(ifbuf->length, M_DEVBUF, M_NOWAIT | M_ZERO);
- if (!iod) {
- rc = ENOMEM;
+ if ((rc = copyin(ioh, iod, iol)) != 0)
goto exit;
- }
- copyin(ioh, iod, ifbuf->length);
- switch (ioh->type) {
+ switch (iod->hdr.type) {
case BNXT_HWRM_NVM_FIND_DIR_ENTRY:
{
struct bnxt_ioctl_hwrm_nvm_find_dir_entry *find =
@@ -1686,7 +1684,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1726,7 +1724,7 @@
remain -= csize;
}
if (iod->hdr.rc == 0)
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
iflib_dma_free(&dma_data);
rc = 0;
@@ -1746,7 +1744,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1766,7 +1764,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1788,7 +1786,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1807,7 +1805,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1827,7 +1825,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1854,7 +1852,7 @@
copyout(dma_data.idi_vaddr, get->data,
get->entry_length * get->entries);
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
iflib_dma_free(&dma_data);
@@ -1875,7 +1873,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1897,7 +1895,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1916,7 +1914,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1937,7 +1935,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1958,7 +1956,7 @@
}
else {
iod->hdr.rc = 0;
- copyout(iod, ioh, ifbuf->length);
+ copyout(iod, ioh, iol);
}
rc = 0;
@@ -1969,8 +1967,6 @@
}
exit:
- if (iod)
- free(iod, M_DEVBUF);
return rc;
}
File Metadata
Details
Attached
Mime Type
text/plain
Expires
Sun, May 17, 8:56 PM (14 h, 29 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
33209171
Default Alt Text
D23933.id69137.diff (3 KB)
Attached To
Mode
D23933: bnxt(4): Fix ioctls when user addresses are inaccessable.
Attached
Detach File
Event Timeline
Log In to Comment