Skip to content

Conversation

@anisa-su993
Copy link
Contributor

Bug was found in request payload allocation size for commands with variable data size payloads.

These 2 commits fixes the bug by adding data size as an input parameter.

Previously, the transfer_fw command looked like the below (with added print statements)

CXLMI_EXPORT int cxlmi_cmd_transfer_fw(struct cxlmi_endpoint *ep, 
                                       struct cxlmi_tunnel_info *ti, 
                                       struct cxlmi_cmd_transfer_fw *in) 
{ 
        struct cxlmi_cmd_transfer_fw *req_pl; 
        _cleanup_free_ struct cxlmi_cci_msg *req = NULL; 
        struct cxlmi_cci_msg rsp; 
        ssize_t req_sz, data_sz = struct_size(in, data, 0); 
        int rc = -1; 
 
        printf("Transfer FW Data Size: %lu\n", data_sz); 
        printf("sizeof(*in): %lu\n", sizeof(*in)); 
        req_sz = sizeof(*req_pl) + data_sz + sizeof(*req); 
 
        printf("req_sz: %lu\n", req_sz); 
        req = calloc(1, req_sz); 
        if (!req) 
                return -1; 
...

When tested with a short test program:

struct cxlmi_cmd_transfer_fw *transfer_fw = calloc(1, sizeof(*transfer_fw) + 27);

 rc =cxlmi_cmd_transfer_fw(ep, NULL, transfer_fw);

The output was:

Transfer FW Data Size: 128
sizeof(*in): 128
req_sz: 268

This showed that the req_payload size, which should have been the size of the request header + the size of the other fields in the transfer_fw struct + 27, but was instead the size of the request header + 2 * (size of the other fields in the transfer_fw struct).

Adds data_sz as an input parameter to the function signature in order to
correctly allocate size of the req payload, similar to the
Set Feature command (0502h) because the fw data size is variable.

Fixes previous incorrect way of calculating req payload size.

Signed-off-by: Anisa Su <anisa.su@samsung.com>
Adds data_sz as an input parameter to the function signature in order to
correctly allocate size of the req payload, similar to the
Set Feature command (0502h) and because the LSA data size is variable.

Fixes previous incorrect way of calculating req payload size.

Signed-off-by: Anisa Su <anisa.su@samsung.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant