[PATCH 2/2] net/bnxt: replace VLA with heap allocation

[Manish Kurup]

From: Dakota Sicher <dakota.sicher at broadcom.com>

ulp_mapper_blob_block_swap() used a variable-length array on the
stack sized by caller input for swap memory. Use a heap allocation
instead to avoid unbounded stack growth.

Fixes: dd0191d5e70d ("net/bnxt/tf_ulp: support Thor2 ULP layer")
Cc: stable at dpdk.org

Signed-off-by: Dakota Sicher <dakota.sicher at broadcom.com>
Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
 drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c b/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
index 2d89f10d5e..934634c606 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_mapper_tfc.c
@@ -388,9 +388,8 @@ static const char * const mpc_error_str[] = {
 static int32_t
 ulp_mapper_blob_block_swap(struct ulp_blob *blob, uint32_t block_sz)
 {
-	uint8_t data[block_sz]; /* size of a block for temp storage */
 	uint16_t num_words, data_sz;
-	uint8_t *pdata;
+	uint8_t *pdata, *data;
 	int i;
 
 	/* Shouldn't happen since it is internal function, but check anyway */
@@ -407,6 +406,12 @@ ulp_mapper_blob_block_swap(struct ulp_blob *blob, uint32_t block_sz)
 		return -EINVAL;
 	}
 
+	data = rte_zmalloc(NULL, block_sz, 0);
+	if (unlikely(!data)) {
+		BNXT_DRV_DBG(ERR, "Failed to allocate swap buffer");
+		return -ENOMEM;
+	}
+
 	num_words = data_sz / block_sz;
 	for (i = 0; i < num_words / 2; i++) {
 		memcpy(data, &pdata[i * block_sz], block_sz);
@@ -415,6 +420,7 @@ ulp_mapper_blob_block_swap(struct ulp_blob *blob, uint32_t block_sz)
 		memcpy(&pdata[(num_words - 1 - i) * block_sz],
 		       data, block_sz);
 	}
+	rte_free(data);
 	return 0;
 }
 
-- 
2.31.1