From: Yonglong Liu liuyonglong@huawei.com
driver inclusion category: bugfix bugzilla: NA CVE: NA
----------------------------
The bd_num query from fireware maybe zero, use zero to alloc buffer may cause override problem.
Signed-off-by: Yonglong Liu liuyonglong@huawei.com Reviewed-by: li yongxin liyongxin1@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- .../net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c index ebbc25cc86940..9af8d019b655b 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c @@ -88,7 +88,7 @@ int hns3_get_port_info(const struct hns3_nic_priv *net_priv, desc_data = (__le32 *)(&desc.data[0]); bd_num = le32_to_cpu(*desc_data);
- if (bd_num * sizeof(struct hclge_desc) > + if (!bd_num || bd_num * sizeof(struct hclge_desc) > sizeof(struct hclge_port_info)) { dev_err(&hdev->pdev->dev, "get invalid BD num %u\n", bd_num); return -EINVAL; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 4ea3b4eb7d354..8f7baf3fdbb38 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -514,6 +514,10 @@ static int hclge_mac_query_reg_num(struct hclge_dev *hdev, u32 *desc_num)
*desc_num = 1 + ((reg_num - 3) >> 2) + (u32)(((reg_num - 3) & 0x3) ? 1 : 0); + if (!(*desc_num)) { + dev_err(&hdev->pdev->dev, "Invalid desc num: %u\n", *desc_num); + return -EINVAL; + }
return 0; } @@ -11205,7 +11209,7 @@ static int hclge_get_dfx_reg(struct hclge_dev *hdev, void *data) for (i = 1; i < dfx_reg_type_num; i++) bd_num_max = max_t(int, bd_num_max, bd_num_list[i]);
- if (bd_num_max > HCLGE_DFX_BD_NUM_MAX) { + if (bd_num_max <= 0 || bd_num_max > HCLGE_DFX_BD_NUM_MAX) { dev_err(&hdev->pdev->dev, "Get dfx reg fail, invalid bd number: %d\n", bd_num_max);