Commit 625f0802 authored by Logan Gunthorpe's avatar Logan Gunthorpe Committed by Jon Mason

ntb_tool: BUG: Ensure the buffer size is large enough to return all spads

On hardware with 32 scratchpad registers the spad field in ntb tool
could chop off the end. The maximum buffer size is increased from
256 to 15 times the number or scratchpads.
Signed-off-by: default avatarLogan Gunthorpe <logang@deltatee.com>
Acked-by: default avatarAllen Hubbe <Allen.Hubbe@emc.com>
Signed-off-by: default avatarJon Mason <jdmason@kudzu.us>
parent c792eba1
...@@ -239,7 +239,14 @@ static ssize_t tool_spadfn_read(struct tool_ctx *tc, char __user *ubuf, ...@@ -239,7 +239,14 @@ static ssize_t tool_spadfn_read(struct tool_ctx *tc, char __user *ubuf,
if (!spad_read_fn) if (!spad_read_fn)
return -EINVAL; return -EINVAL;
buf_size = min_t(size_t, size, 0x100); spad_count = ntb_spad_count(tc->ntb);
/*
* We multiply the number of spads by 15 to get the buffer size
* this is from 3 for the %d, 10 for the largest hex value
* (0x00000000) and 2 for the tab and line feed.
*/
buf_size = min_t(size_t, size, spad_count * 15);
buf = kmalloc(buf_size, GFP_KERNEL); buf = kmalloc(buf_size, GFP_KERNEL);
if (!buf) if (!buf)
...@@ -247,7 +254,6 @@ static ssize_t tool_spadfn_read(struct tool_ctx *tc, char __user *ubuf, ...@@ -247,7 +254,6 @@ static ssize_t tool_spadfn_read(struct tool_ctx *tc, char __user *ubuf,
pos = 0; pos = 0;
spad_count = ntb_spad_count(tc->ntb);
for (i = 0; i < spad_count; ++i) { for (i = 0; i < spad_count; ++i) {
pos += scnprintf(buf + pos, buf_size - pos, "%d\t%#x\n", pos += scnprintf(buf + pos, buf_size - pos, "%d\t%#x\n",
i, spad_read_fn(tc->ntb, i)); i, spad_read_fn(tc->ntb, i));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment