[PATCH v3 11/14] common/sfc_efx/base: fix flex array in netport stat describe

From: Andy Moreton <[email protected]>

Code analysis reported returning uninitialised memory at *lut and
*nprocessedp. Refactor to ensure these parameters are only used
when non-NULL.

This function should also be using the ENTRY_COUNT field for the
number of descriptors returned, as the descriptor size is not
known statically (they are extensible). Also use the MORE_ENTRIES
flag to determine if all of the descriptors have been fetched.

Fixes: f2f77453cb9f ("common/sfc_efx/base: fill in software LUT for MAC statistics")
Cc: [email protected]

Signed-off-by: Andy Moreton <[email protected]>
Reviewed-by: Ivan Malov <[email protected]>
Reviewed-by: Viacheslav Galaktionov <[email protected]>
---
 drivers/common/sfc_efx/base/efx_np.c | 39 +++++++++++++++++++---------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/drivers/common/sfc_efx/base/efx_np.c b/drivers/common/sfc_efx/base/efx_np.c
index e7ca6d3302..ec76985054 100644
--- a/drivers/common/sfc_efx/base/efx_np.c
+++ b/drivers/common/sfc_efx/base/efx_np.c
@@ -782,10 +782,11 @@ efx_np_stats_describe(
 	__out_opt			uint32_t *nstats_maxp)
 {
 	uint8_t *payload = NULL;
-	uint32_t nprocessed;
 	efx_mcdi_req_t req;
 	uint8_t *entries;
 	uint32_t stride;
+	uint32_t count;
+	uint32_t more;
 	unsigned int i;
 	size_t out_sz;
 	size_t size;
@@ -828,29 +829,43 @@ efx_np_stats_describe(
 		    sizeof (efx_qword_t);
 	}
 
-	if (lut_nentries == 0 || lut == NULL || nprocessedp == NULL)
-		goto out;
-
 	stride = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_SIZE);
-	nprocessed = MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES_NUM(out_sz);
-	if (nprocessed == 0) {
+	count = MCDI_OUT_DWORD(req, MAC_STATISTICS_DESCRIPTOR_OUT_ENTRY_COUNT);
+	more = MCDI_OUT_DWORD_FIELD(req,
+	    MAC_STATISTICS_DESCRIPTOR_OUT_FLAGS,
+	    MAC_STATISTICS_DESCRIPTOR_OUT_MORE_ENTRIES);
+
+	if ((count == 0) && (more != 0)) {
 		rc = EMSGSIZE;
 		goto fail4;
 	}
 
-	entries = MCDI_OUT2(req, uint8_t,
-	    MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES);
+	if (count > 0 && (stride < MC_CMD_STAT_DESC_LEN || count >
+	    (out_sz - MC_CMD_MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES_OFST) /
+	    stride)) {
+		rc = EMSGSIZE;
+		goto fail5;
+	}
+
+	if (lut != NULL) {
+		entries = MCDI_OUT2(req, uint8_t,
+		    MAC_STATISTICS_DESCRIPTOR_OUT_ENTRIES);
 
-	for (i = 0; i < nprocessed; ++i)
-		efx_np_stat_describe(entries + i * stride, lut_nentries, lut);
+		for (i = 0; i < count; ++i) {
+			efx_np_stat_describe(entries + i * stride,
+			    lut_nentries, lut);
+		}
+	}
 
-	*nprocessedp = nprocessed;
+	if (nprocessedp != NULL)
+		*nprocessedp = count;
 
-out:
 	EFSYS_KMEM_FREE(enp->en_esip, size, payload);
 
 	return (0);
 
+fail5:
+	EFSYS_PROBE(fail5);
 fail4:
 	EFSYS_PROBE(fail4);
 fail3:
-- 
2.47.3