[ck] [PATCH openEuler v1 010/119] openeuler: net: hinic: fix bug in api_csr_write

From: Xue &lt;xuechaojing(a)huawei.com&gt; commit 478335c2ebcd3c8a8a8049c2ace7a64769e107a3 openEuler-1.0 driver inclusion category:bugfix bugzilla:4472 CVE:NA ------------------------------------------------------------------------ This patch fix bug in api_csr_write. Reviewed-by: chiqijun &lt;chiqijun(a)huawei.com&gt; Signed-off-by: Wu Like &lt;wulike1(a)huawei.com&gt; Signed-off-by: Xue &lt;xuechaojing(a)huawei.com&gt; Reviewed-by: Yang Yingliang &lt;yangyingliang(a)huawei.com&gt; Signed-off-by: Yang Yingliang &lt;yangyingliang(a)huawei.com&gt; Signed-off-by: Xin Hao &lt;haoxing990(a)gmail.com&gt; --- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index 2539b7524612..f213f2cd660e 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -1370,10 +1370,12 @@ static int api_csr_write(void *hwdev, struct msg_module *nt_msg, rd_addr = csr_write_msg->addr; node_id = (u8)nt_msg->up_cmd.up_db.comm_mod_type; - rd_cnt = rd_len / 4; - if (rd_len % 4) - rd_cnt++; + if (rd_len % 4) { + pr_err("Csr length must be a multiple of 4\n"); + return -EFAULT; + } + rd_cnt = rd_len / 4; data = kzalloc(rd_len, GFP_KERNEL); if (!data) { pr_err("No more memory\n"); @@ -1388,7 +1390,7 @@ static int api_csr_write(void *hwdev, struct msg_module *nt_msg, for (i = 0; i < rd_cnt; i++) { ret = hinic_api_csr_wr32(hwdev, node_id, rd_addr + offset, - *(data + offset)); + *((u32 *)(data + offset))); if (ret) { pr_err("Csr wr fail, ret: %d, node_id: %d, csr addr: 0x%08x\n", ret, rd_addr + offset, node_id); -- 2.31.0