From: Chiqijun chiqijun@huawei.com
driver inclusion category: bugfix bugzilla: 4472
-----------------------------------------------------------------------
When the user mode tool sets ETS, the input value tc id exceeds the maximum value of 7, which will cause the array to be accessed out of bounds. Driver check the legality of tc id.
Signed-off-by: Chiqijun chiqijun@huawei.com Reviewed-by: Zengweiliang zengweiliang.zengweiliang@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index 740ec4adf6baa..04d40e60d8bba 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -769,8 +769,19 @@ int set_ets(struct hinic_nic_dev *nic_dev, void *buf_in, err = 0xff; goto exit; } - if (ets.flag_com.ets_flag.flag_ets_cos) + + if (ets.flag_com.ets_flag.flag_ets_cos) { + for (i = 0; i < HINIC_DCB_COS_MAX; i++) { + if (ets.tc[i] >= HINIC_DCB_TC_MAX) { + nicif_err(nic_dev, drv, nic_dev->netdev, + "ETS tc id %d out of range\n", + ets.tc[i]); + err = 0xFF; + goto exit; + } + } hinic_dcbnl_set_ets_tc_tool(nic_dev->netdev, ets.tc, true); + }
if (ets.flag_com.ets_flag.flag_ets_percent) { for (i = support_tc; i < HINIC_DCB_TC_MAX; i++) {