From: Yonglong Liu <liuyonglong@huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------- The bd_num is from firmware, it may be bigger than the size of struct hclge_port_info, and may cause memory override problem. Signed-off-by: Yonglong Liu <liuyonglong@huawei.com> Reviewed-by: Jian Shen <shenjian15@huawei.com> Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- .../net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c index 5404048ad60d1..ebbc25cc86940 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c @@ -88,9 +88,9 @@ int hns3_get_port_info(const struct hns3_nic_priv *net_priv, desc_data = (__le32 *)(&desc.data[0]); bd_num = le32_to_cpu(*desc_data); - if (bd_num > hdev->hw.cmq.csq.desc_num) { - dev_err(&hdev->pdev->dev, "get invalid BD num %u(max %u)\n", - bd_num, hdev->hw.cmq.csq.desc_num); + if (bd_num * sizeof(struct hclge_desc) > + sizeof(struct hclge_port_info)) { + dev_err(&hdev->pdev->dev, "get invalid BD num %u\n", bd_num); return -EINVAL; } -- 2.25.1