git: b6bff124973e - stable/15 - ixgbe: fix unaligned access in ixgbe_update_flash_X550()

Kevin Bowling <[email protected]>
Newsgroups gmane.os.freebsd.devel.cvs.src
Message-ID <6a767a7e.3f229.5005d7ea__8105.33141936816$1786149594$gmane$org@gitrepo.freebsd.org>
The branch stable/15 has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=b6bff124973e231237ed8c4df6144b7cb3a81d33

commit b6bff124973e231237ed8c4df6144b7cb3a81d33
Author:     Kevin Bowling <[email protected]>
AuthorDate: 2026-07-28 11:09:39 +0000
Commit:     Kevin Bowling <[email protected]>
CommitDate: 2026-08-08 00:35:52 +0000

    ixgbe: fix unaligned access in ixgbe_update_flash_X550()
    
    ixgbe_host_interface_command() treats its buffer as a u32 array.  The
    local union contained only byte-sized fields, giving it one-byte stack
    alignment and allowing unaligned accesses on strict-align systems.
    
    Add a u32 member to the union to provide the required alignment and
    pass that member to ixgbe_host_interface_command().
    
    No functional change is expected on x86.
    
    Obtained from:  Intel ix 3.4.39
    
    (cherry picked from commit 8fa2a7503468abb5f863729c4e244d738239503d)
---
 sys/dev/ixgbe/ixgbe_type.h | 1 +
 sys/dev/ixgbe/ixgbe_x550.c | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/dev/ixgbe/ixgbe_type.h b/sys/dev/ixgbe/ixgbe_type.h
index 4e242b7189cb..80f8effca6d5 100644
--- a/sys/dev/ixgbe/ixgbe_type.h
+++ b/sys/dev/ixgbe/ixgbe_type.h
@@ -3273,6 +3273,7 @@ struct ixgbe_hic_hdr2_rsp {
 };
 
 union ixgbe_hic_hdr2 {
+	u32 buf[1];
 	struct ixgbe_hic_hdr2_req req;
 	struct ixgbe_hic_hdr2_rsp rsp;
 };
diff --git a/sys/dev/ixgbe/ixgbe_x550.c b/sys/dev/ixgbe/ixgbe_x550.c
index 7f07190f832c..f6ce0d10b9e2 100644
--- a/sys/dev/ixgbe/ixgbe_x550.c
+++ b/sys/dev/ixgbe/ixgbe_x550.c
@@ -3557,8 +3557,7 @@ s32 ixgbe_update_flash_X550(struct ixgbe_hw *hw)
 	buffer.req.buf_lenl = FW_SHADOW_RAM_DUMP_LEN;
 	buffer.req.checksum = FW_DEFAULT_CHECKSUM;
 
-	status = ixgbe_host_interface_command(hw, (u32 *)&buffer,
-					      sizeof(buffer),
+	status = ixgbe_host_interface_command(hw, buffer.buf, sizeof(buffer),
 					      IXGBE_HI_COMMAND_TIMEOUT, false);
 
 	return status;
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.