lkml.org 
[lkml]   [2021]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH net 4/6] net: hns3: check queue id range before using
    Date
    From: Yufeng Mo <moyufeng@huawei.com>

    The input parameters may not be reliable. Before using the
    queue id, we should check this parameter. Otherwise, memory
    overwriting may occur.

    Fixes: d34100184685 ("net: hns3: refactor the mailbox message between PF and VF")
    Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
    Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
    ---
    drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
    index 07aa6ada4fdb..65d78ee4d65a 100644
    --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
    +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
    @@ -590,9 +590,17 @@ static void hclge_get_queue_id_in_pf(struct hclge_vport *vport,
    struct hclge_mbx_vf_to_pf_cmd *mbx_req,
    struct hclge_respond_to_vf_msg *resp_msg)
    {
    + struct hnae3_handle *handle = &vport->nic;
    + struct hclge_dev *hdev = vport->back;
    u16 queue_id, qid_in_pf;

    memcpy(&queue_id, mbx_req->msg.data, sizeof(queue_id));
    + if (queue_id >= handle->kinfo.num_tqps) {
    + dev_err(&hdev->pdev->dev, "Invalid queue id(%u) from VF %u\n",
    + queue_id, mbx_req->mbx_src_vfid);
    + return;
    + }
    +
    qid_in_pf = hclge_covert_handle_qid_global(&vport->nic, queue_id);
    memcpy(resp_msg->data, &qid_in_pf, sizeof(qid_in_pf));
    resp_msg->len = sizeof(qid_in_pf);
    --
    2.33.0
    \
     
     \ /
      Last update: 2021-09-15 15:57    [W:4.210 / U:0.268 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site