From: shenhao shenhao21@huawei.com
driver inclusion category: bugfix bugzilla: NA CVE: NA
---------------------------------------------------
There is a risk that causing index out of bounds error when using memcpy() without checking the length of the size to be copyed. This patch fixes it, which will make the code more reliable.
Signed-off-by: Guojia Liao liaoguojia@huawei.com Signed-off-by: shenhao shenhao21@huawei.com Reviewed-by: Zhong Zhaohui zhongzhaohui@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c index f4204ca..0ba9fe6 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c @@ -3358,10 +3358,19 @@ static void hclgevf_get_regs(struct hnae3_handle *handle, u32 *version, void hclgevf_update_port_base_vlan_info(struct hclgevf_dev *hdev, u16 state, u8 *port_base_vlan_info, u8 data_size) { +#define MAX_LENGTH_OF_PORT_BASE_VLAN_INFO 8U struct hnae3_handle *nic = &hdev->nic; struct hclge_vf_to_pf_msg send_msg; int ret;
+ if (data_size > MAX_LENGTH_OF_PORT_BASE_VLAN_INFO) { + dev_info(&hdev->pdev->dev, + "the VF info len %u exceeds max len %u\n", + data_size, MAX_LENGTH_OF_PORT_BASE_VLAN_INFO); + /* If data_size is too long, set the value to max length */ + data_size = MAX_LENGTH_OF_PORT_BASE_VLAN_INFO; + } + rtnl_lock();
if (test_bit(HCLGEVF_STATE_RST_HANDLING, &hdev->state)) {