[PATCH v2] net/bnxt/tf_core: fix TCAM alloc-set key copy

[Manish Kurup]

In tfc_msg_tcam_alloc_set(), the key, mask and remap are copied into
the HWRM request with memcpy() using the address of the local
pointer variables (&key, &mask, &remap) as the source instead of the
data they point to. The copy lengths are also computed as
size * sizeof(uint32_t), although key_size and remap_size are
already byte counts, so each copy is four times too long and can run
past the 2 * key_size + remap_size bytes reserved in the request.

Copy from the key, mask and remap buffers themselves, and use the
byte sizes directly.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
Cc: stable at dpdk.org

Signed-off-by: Manish Kurup <manish.kurup at broadcom.com>
---
v2:
* Split out of "net/bnxt: fix multiple truflow defects" (one fix per
  patch); this is the tfc_msg_tcam_alloc_set() fix.
* New subject and commit message; single Fixes: tag.

 drivers/net/bnxt/tf_core/v3/tfc_msg.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/bnxt/tf_core/v3/tfc_msg.c b/drivers/net/bnxt/tf_core/v3/tfc_msg.c
index 89c256b810..af74007747 100644
--- a/drivers/net/bnxt/tf_core/v3/tfc_msg.c
+++ b/drivers/net/bnxt/tf_core/v3/tfc_msg.c
@@ -1088,9 +1088,9 @@ tfc_msg_tcam_alloc_set(struct tfc *tfcp, uint16_t fid, uint16_t sid,
 		data = &req.dev_data[0];
 	}
 
-	memcpy(&data[0], &key, key_size * sizeof(uint32_t));
-	memcpy(&data[key_size], &mask, key_size * sizeof(uint32_t));
-	memcpy(&data[key_size * 2], &remap, remap_size * sizeof(uint32_t));
+	memcpy(&data[0], key, key_size);
+	memcpy(&data[key_size], mask, key_size);
+	memcpy(&data[key_size * 2], remap, remap_size);
 	rc = bnxt_hwrm_tf_message_direct(bp, false, HWRM_TFC_TCAM_ALLOC_SET,
 					 &req, sizeof(req), &resp, sizeof(resp));
 
-- 
2.31.1