From: Chiqijun <chiqijun@huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- The statistics saved by the driver are 110K. The tool only obtains 4K at a time. When the last time it is obtained, the length calculation is wrong, which may lead to out-of-bounds copy. Signed-off-by: Chiqijun <chiqijun@huawei.com> Reviewed-by: Zengweiliang <zengweiliang.zengweiliang@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c index ab47805ca369..e49a21fa952e 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_dbg.c @@ -253,8 +253,6 @@ u16 hinic_dbg_clear_hw_stats(void *hwdev) void hinic_get_chip_fault_stats(const void *hwdev, u8 *chip_fault_stats, int offset) { - int copy_len = offset + MAX_DRV_BUF_SIZE - HINIC_CHIP_FAULT_SIZE; - if (offset < 0 || offset > HINIC_CHIP_FAULT_SIZE) { pr_err("Invalid chip offset value: %d\n", offset); return; @@ -267,7 +265,7 @@ void hinic_get_chip_fault_stats(const void *hwdev, else memcpy(chip_fault_stats, ((struct hinic_hwdev *)hwdev)->chip_fault_stats + offset, - copy_len); + HINIC_CHIP_FAULT_SIZE - offset); } int hinic_dbg_get_pf_bw_limit(void *hwdev, u32 *pf_bw_limit) -- 2.25.1