From owner-svn-src-all@FreeBSD.ORG Thu Nov 14 18:53:18 2013 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8A6226BB; Thu, 14 Nov 2013 18:53:18 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 744D22513; Thu, 14 Nov 2013 18:53:18 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id rAEIrIcw044141; Thu, 14 Nov 2013 18:53:18 GMT (envelope-from delphij@svn.freebsd.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id rAEIrI6h044139; Thu, 14 Nov 2013 18:53:18 GMT (envelope-from delphij@svn.freebsd.org) Message-Id: <201311141853.rAEIrI6h044139@svn.freebsd.org> From: Xin LI Date: Thu, 14 Nov 2013 18:53:18 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r258140 - head/sys/dev/oce X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Nov 2013 18:53:18 -0000 Author: delphij Date: Thu Nov 14 18:53:17 2013 New Revision: 258140 URL: http://svnweb.freebsd.org/changeset/base/258140 Log: The previous code makes a memory allocation in size of struct mbx_common_read_write_flashrom plus 32KB and caps the actual transfer size at 32KB. This is harmless as it is but may confuse static code analyzer, so allocate a full 32KB instead. Reported by: Coverity via mjacob Submitted by: Venkata Duvvuru Coverity CID: 1125820 Modified: head/sys/dev/oce/oce_hw.h head/sys/dev/oce/oce_sysctl.c Modified: head/sys/dev/oce/oce_hw.h ============================================================================== --- head/sys/dev/oce/oce_hw.h Thu Nov 14 18:41:58 2013 (r258139) +++ head/sys/dev/oce/oce_hw.h Thu Nov 14 18:53:17 2013 (r258140) @@ -1577,7 +1577,8 @@ struct mbx_common_read_write_flashrom { uint32_t flash_op_type; uint32_t data_buffer_size; uint32_t data_offset; - uint8_t data_buffer[4]; /* + IMAGE_TRANSFER_SIZE */ + uint8_t data_buffer[32768]; /* + IMAGE_TRANSFER_SIZE */ + uint8_t rsvd[4]; }; struct oce_phy_info { Modified: head/sys/dev/oce/oce_sysctl.c ============================================================================== --- head/sys/dev/oce/oce_sysctl.c Thu Nov 14 18:41:58 2013 (r258139) +++ head/sys/dev/oce/oce_sysctl.c Thu Nov 14 18:53:17 2013 (r258140) @@ -381,8 +381,8 @@ oce_sh_be3_flashdata(POCE_SOFTC sc, cons return EINVAL; } - rc = oce_dma_alloc(sc, sizeof(struct mbx_common_read_write_flashrom) - + 32*1024, &dma_mem, 0); + rc = oce_dma_alloc(sc, sizeof(struct mbx_common_read_write_flashrom), + &dma_mem, 0); if (rc) { device_printf(sc->dev, "Memory allocation failure while flashing\n");