diff options
| author | davidcs <davidcs@FreeBSD.org> | 2013-11-22 00:26:21 +0000 |
|---|---|---|
| committer | davidcs <davidcs@FreeBSD.org> | 2013-11-22 00:26:21 +0000 |
| commit | 829067b4458c662a9ed51ddc39fc88a27bbe93a9 (patch) | |
| tree | 7fb84e8c1a809037a47314dbb824484cf8839573 /sys/dev/qlxge | |
| parent | 877516e51a1928de8c1d9f1cd1c3e3bf0260e124 (diff) | |
| download | FreeBSD-src-829067b4458c662a9ed51ddc39fc88a27bbe93a9.zip FreeBSD-src-829067b4458c662a9ed51ddc39fc88a27bbe93a9.tar.gz | |
MFC r258155
ql_hw.[c,h]: set minimum thresholds on pkt size for lro path.
ql_ioctl.c: validate the length and address of buffer passed to QL_RD_FW_DUMP
MFC r258156
qls_ioctl.c: Validate the buffer and its length passed to QLA_MPI_DUMP.
copyout dump only if qls_mpi_core_dump() is successful.
(like to credit x90c for pointing the issue)
Approved by: re (delphij)
Diffstat (limited to 'sys/dev/qlxge')
| -rw-r--r-- | sys/dev/qlxge/qls_ioctl.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/sys/dev/qlxge/qls_ioctl.c b/sys/dev/qlxge/qls_ioctl.c index 5afa776..6b39fc9 100644 --- a/sys/dev/qlxge/qls_ioctl.c +++ b/sys/dev/qlxge/qls_ioctl.c @@ -100,13 +100,16 @@ qls_eioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag, if (mpi_dump->size == 0) { mpi_dump->size = sizeof (qls_mpi_coredump_t); } else { - if (mpi_dump->size < sizeof (qls_mpi_coredump_t)) + if ((mpi_dump->size != sizeof (qls_mpi_coredump_t)) || + (mpi_dump->dbuf == NULL)) rval = EINVAL; else { - qls_mpi_core_dump(ha); - rval = copyout( &ql_mpi_coredump, - mpi_dump->dbuf, - mpi_dump->size); + if (qls_mpi_core_dump(ha) == 0) { + rval = copyout(&ql_mpi_coredump, + mpi_dump->dbuf, + mpi_dump->size); + } else + rval = ENXIO; if (rval) { device_printf(ha->pci_dev, |
