git: a83be0b237bc - main - iw_cxgbe: Do not dma memory off of the stack

The branch main has been updated by jhb:

URL: https://cgit.FreeBSD.org/src/commit/?id=a83be0b237bccff39301fbaa43353f2dbd34e719

commit a83be0b237bccff39301fbaa43353f2dbd34e719
Author:     Greg KH <gregkh@linuxfoundation.org>
AuthorDate: 2019-10-01 16:56:11 +0000
Commit:     John Baldwin <jhb@FreeBSD.org>
CommitDate: 2026-09-15 14:22:40 +0000

    iw_cxgbe: Do not dma memory off of the stack
    
    Obtained from:  Linux commit 3840c5b78803b2b6cc1ff820100a74a092c40cbb
---
 sys/dev/cxgbe/iw_cxgbe/mem.c | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/sys/dev/cxgbe/iw_cxgbe/mem.c b/sys/dev/cxgbe/iw_cxgbe/mem.c
index 61f7888ca1cb..117a2efdfc0e 100644
--- a/sys/dev/cxgbe/iw_cxgbe/mem.c
+++ b/sys/dev/cxgbe/iw_cxgbe/mem.c
@@ -206,13 +206,17 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
 			   struct c4iw_wr_wait *wr_waitp)
 {
 	int err;
-	struct fw_ri_tpte tpt;
+	struct fw_ri_tpte *tpt;
 	u32 stag_idx;
 	static atomic_t key;
 
 	if (c4iw_stopped(rdev))
 		return -EIO;
 
+	tpt = kmalloc(sizeof(*tpt), GFP_KERNEL);
+	if (!tpt)
+		return -ENOMEM;
+
 	stag_state = stag_state > 0;
 	stag_idx = (*stag) >> 8;
 
@@ -222,6 +226,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
 			mutex_lock(&rdev->stats.lock);
 			rdev->stats.stag.fail++;
 			mutex_unlock(&rdev->stats.lock);
+			kfree(tpt);
 			return -ENOMEM;
 		}
 		mutex_lock(&rdev->stats.lock);
@@ -237,30 +242,30 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
 
 	/* write TPT entry */
 	if (reset_tpt_entry)
-		memset(&tpt, 0, sizeof(tpt));
+		memset(tpt, 0, sizeof(*tpt));
 	else {
 		if (page_size > ilog2(C4IW_MAX_PAGE_SIZE) - 12)
 			return -EINVAL;
-		tpt.valid_to_pdid = cpu_to_be32(F_FW_RI_TPTE_VALID |
+		tpt->valid_to_pdid = cpu_to_be32(F_FW_RI_TPTE_VALID |
 			V_FW_RI_TPTE_STAGKEY((*stag & M_FW_RI_TPTE_STAGKEY)) |
 			V_FW_RI_TPTE_STAGSTATE(stag_state) |
 			V_FW_RI_TPTE_STAGTYPE(type) | V_FW_RI_TPTE_PDID(pdid));
-		tpt.locread_to_qpid = cpu_to_be32(V_FW_RI_TPTE_PERM(perm) |
+		tpt->locread_to_qpid = cpu_to_be32(V_FW_RI_TPTE_PERM(perm) |
 			(bind_enabled ? F_FW_RI_TPTE_MWBINDEN : 0) |
 			V_FW_RI_TPTE_ADDRTYPE((zbva ? FW_RI_ZERO_BASED_TO :
 						      FW_RI_VA_BASED_TO))|
 			V_FW_RI_TPTE_PS(page_size));
-		tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
+		tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
 			V_FW_RI_TPTE_PBLADDR(PBL_OFF(rdev, pbl_addr)>>3));
-		tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
-		tpt.va_hi = cpu_to_be32((u32)(to >> 32));
-		tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
-		tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
-		tpt.len_hi = cpu_to_be32((u32)(len >> 32));
+		tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
+		tpt->va_hi = cpu_to_be32((u32)(to >> 32));
+		tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
+		tpt->dca_mwbcnt_pstag = cpu_to_be32(0);
+		tpt->len_hi = cpu_to_be32((u32)(len >> 32));
 	}
 	err = write_adapter_mem(rdev, stag_idx +
 				(rdev->adap->vres.stag.start >> 5),
-				sizeof(tpt), &tpt, wr_waitp);
+				sizeof(*tpt), tpt, wr_waitp);
 
 	if (reset_tpt_entry) {
 		t4_stag_free(rdev->adap, stag_idx, 1);
@@ -268,6 +273,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
 		rdev->stats.stag.cur -= 32;
 		mutex_unlock(&rdev->stats.lock);
 	}
+	kfree(tpt);
 	return err;
 }