[PATCH] net: ldpaa_eth: Fix buffer overflow in memset
Andrew Goodbody
andrew.goodbody at linaro.org
Tue Aug 5 12:52:00 CEST 2025
In ldpaa_eth_open a memset is used to initialise a struct to 0 but the
size passed is that of a different struct. Correct to pass the sizeof
the struct that is being initialised.
This issue was found by Smatch.
Signed-off-by: Andrew Goodbody <andrew.goodbody at linaro.org>
---
drivers/net/ldpaa_eth/ldpaa_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ldpaa_eth/ldpaa_eth.c b/drivers/net/ldpaa_eth/ldpaa_eth.c
index b72198ca530..94e62748239 100644
--- a/drivers/net/ldpaa_eth/ldpaa_eth.c
+++ b/drivers/net/ldpaa_eth/ldpaa_eth.c
@@ -458,7 +458,7 @@ static int ldpaa_eth_open(struct udevice *dev)
link_state.up == 1 ? printf("up\n") : printf("error state\n");
#endif
- memset(&d_queue, 0, sizeof(struct dpni_queue));
+ memset(&d_queue, 0, sizeof(struct dpni_queue_id));
err = dpni_get_queue(dflt_mc_io, MC_CMD_NO_FLAGS,
dflt_dpni->dpni_handle, DPNI_QUEUE_RX,
0, 0, &d_queue_cfg, &d_queue);
---
base-commit: 007610da2cca405ea7739fc120d90085be4b6ac2
change-id: 20250805-ldpaa_eth-ccbbb28916a0
Best regards,
--
Andrew Goodbody <andrew.goodbody at linaro.org>
More information about the U-Boot
mailing list