git: ena(4): Fix possible NULL deref in ena_com_create_and_store_tx_meta_desc()
Aaron LI
aly at crater.dragonflybsd.org
Tue Oct 13 04:50:41 PDT 2026
commit eed3ec1e51f9c4255f1f5aafe8683d60cccfedf2
Author: Aaron LI <aly at aaronly.me>
Date: Tue Oct 13 16:40:37 2026 +0800
ena(4): Fix possible NULL deref in ena_com_create_and_store_tx_meta_desc()
get_sq_desc() may return NULL, so passing the return value to memset()
would cause a NULL deref. GCC 12.5 caught this and gave a
-Warray-bounds warning:
```
In file included from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_plat.h:40,
from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_com.h:38,
from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.h:40,
from /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:34:
In function 'ena_com_create_and_store_tx_meta_desc',
inlined from 'ena_com_prepare_tx' at /usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:409:3:
dragonfly/sys/systm.h:268:9: warning: '__builtin_memset' offset [0, 11] is out of the bounds [0, 0] [-Warray-bounds]
268 | __builtin_memset(__DEQUALIFY(void *, (ptr)), (c), (len))
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/src/sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c:295:9: note: in expansion of macro 'memset'
295 | memset(meta_desc, 0x0, sizeof(struct ena_eth_io_tx_meta_desc));
| ^~~~~~
```
Fix it by porting the minimal changes from FreeBSD.
Summary of changes:
sys/dev/virtual/amazon/ena/ena-com/ena_eth_com.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/eed3ec1e51f9c4255f1f5aafe8683d60cccfedf2
--
DragonFly BSD source repository
More information about the Commits
mailing list