diff options
| author | davidcs <davidcs@FreeBSD.org> | 2013-11-15 01:26:24 +0000 |
|---|---|---|
| committer | davidcs <davidcs@FreeBSD.org> | 2013-11-15 01:26:24 +0000 |
| commit | ab896e34f3db63abebd888b51ef8cb6f9864317d (patch) | |
| tree | 194a416eed8a8c0a79a0498cb4761c6a42c8aa9d /sys/dev/qlxgbe/ql_ioctl.c | |
| parent | 3abf260fe5f2cd7aa3c10da090e081922d496da1 (diff) | |
| download | FreeBSD-src-ab896e34f3db63abebd888b51ef8cb6f9864317d.zip FreeBSD-src-ab896e34f3db63abebd888b51ef8cb6f9864317d.tar.gz | |
ql_hw.[c,h]: set minimum thresholds on pkt size for lro path.
ql_ioctl.c: validate the length and address of buffer passed to QL_RD_FW_DUMP
Submitted by:David C Somayajulu
Diffstat (limited to 'sys/dev/qlxgbe/ql_ioctl.c')
| -rw-r--r-- | sys/dev/qlxgbe/ql_ioctl.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/sys/dev/qlxgbe/ql_ioctl.c b/sys/dev/qlxgbe/ql_ioctl.c index 8ee74a5..cc47e3f 100644 --- a/sys/dev/qlxgbe/ql_ioctl.c +++ b/sys/dev/qlxgbe/ql_ioctl.c @@ -223,6 +223,13 @@ ql_eioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag, } fw_dump = (qla_rd_fw_dump_t *)data; + + if ((fw_dump->md_template == NULL) || + (fw_dump->template_size != ha->hw.dma_buf.minidump.size)) { + rval = EINVAL; + break; + } + if ((rval = copyout(ha->hw.dma_buf.minidump.dma_b, fw_dump->md_template, fw_dump->template_size))) rval = ENXIO; |
