From 1f0d45605bf3f9d67853cbda925630eb8dc890a2 Mon Sep 17 00:00:00 2001 From: Xue Date: Wed, 10 Jul 2019 16:18:13 +0800 Subject: [PATCH 2768/2944] openeuler: net: hinic: fix bug in api_csr_write commit 478335c2ebcd3c8a8a8049c2ace7a64769e107a3 openEuler-1.0 driver inclusion category:bugfix bugzilla:4472 CVE:NA ------------------------------------------------------------------------ This patch fix bug in api_csr_write. Reviewed-by: chiqijun Signed-off-by: Wu Like Signed-off-by: Xue Reviewed-by: Yang Yingliang Signed-off-by: Yang Yingliang Signed-off-by: Xin Hao Reviewed-by: Baolin Wang --- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index 2539b75..f213f2c 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -1370,10 +1370,12 @@ static int api_csr_write(void *hwdev, struct msg_module *nt_msg, rd_addr = csr_write_msg->addr; node_id = (u8)nt_msg->up_cmd.up_db.comm_mod_type; - rd_cnt = rd_len / 4; - if (rd_len % 4) - rd_cnt++; + if (rd_len % 4) { + pr_err("Csr length must be a multiple of 4\n"); + return -EFAULT; + } + rd_cnt = rd_len / 4; data = kzalloc(rd_len, GFP_KERNEL); if (!data) { pr_err("No more memory\n"); @@ -1388,7 +1390,7 @@ static int api_csr_write(void *hwdev, struct msg_module *nt_msg, for (i = 0; i < rd_cnt; i++) { ret = hinic_api_csr_wr32(hwdev, node_id, rd_addr + offset, - *(data + offset)); + *((u32 *)(data + offset))); if (ret) { pr_err("Csr wr fail, ret: %d, node_id: %d, csr addr: 0x%08x\n", ret, rd_addr + offset, node_id); -- 1.8.3.1