[PATCH] net: ldpaa_eth: Fix buffer overflow in memset

Andrew Goodbody andrew.goodbody at linaro.org
Tue Aug 5 12:52:00 CEST 2025


In ldpaa_eth_open a memset is used to initialise a struct to 0 but the
size passed is that of a different struct. Correct to pass the sizeof
the struct that is being initialised.

This issue was found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody at linaro.org>
---
 drivers/net/ldpaa_eth/ldpaa_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ldpaa_eth/ldpaa_eth.c b/drivers/net/ldpaa_eth/ldpaa_eth.c
index b72198ca530..94e62748239 100644
--- a/drivers/net/ldpaa_eth/ldpaa_eth.c
+++ b/drivers/net/ldpaa_eth/ldpaa_eth.c
@@ -458,7 +458,7 @@ static int ldpaa_eth_open(struct udevice *dev)
 	link_state.up == 1 ? printf("up\n") : printf("error state\n");
 #endif
 
-	memset(&d_queue, 0, sizeof(struct dpni_queue));
+	memset(&d_queue, 0, sizeof(struct dpni_queue_id));
 	err = dpni_get_queue(dflt_mc_io, MC_CMD_NO_FLAGS,
 			     dflt_dpni->dpni_handle, DPNI_QUEUE_RX,
 			     0, 0, &d_queue_cfg, &d_queue);

---
base-commit: 007610da2cca405ea7739fc120d90085be4b6ac2
change-id: 20250805-ldpaa_eth-ccbbb28916a0

Best regards,
-- 
Andrew Goodbody <andrew.goodbody at linaro.org>



More information about the U-Boot mailing list