Messages in this thread Patch in this message |  | | From | Junrui Luo <> | | Date | Sun, 05 Apr 2026 16:15:44 +0800 | | Subject | [PATCH] RDMA/hns: fix out-of-bounds write in IRQ array during configuration |
| |
hns_roce_hw_v2_get_cfg() writes IRQ vector numbers into hr_dev->irq[] using handle->rinfo.num_vectors as the loop bound. num_vectors originates from firmware via hclge_query_pf_resource() without validation against the array size.
If firmware reports more than 128 MSI-X vectors for RoCE, the loop overflows hr_dev->irq[], corrupting adjacent struct members in the heap-allocated hns_roce_dev structure.
Fix by clamping num_vectors to HNS_ROCE_MAX_IRQ_NUM before the loop.
Fixes: 0b567cde9d7a ("RDMA/hns: Enable RoCE on virtual functions") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Junrui Luo <moonafterrain@outlook.com> --- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index fa36700d0db2..6983f39d7333 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -7288,6 +7288,12 @@ static void hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev, addrconf_addr_eui48((u8 *)&hr_dev->ib_dev.node_guid, hr_dev->iboe.netdevs[0]->dev_addr); + if (handle->rinfo.num_vectors > HNS_ROCE_MAX_IRQ_NUM) { + dev_warn(hr_dev->dev, "num_vectors %d exceeds max %d, clamping\n", + handle->rinfo.num_vectors, HNS_ROCE_MAX_IRQ_NUM); + handle->rinfo.num_vectors = HNS_ROCE_MAX_IRQ_NUM; + } + for (i = 0; i < handle->rinfo.num_vectors; i++) hr_dev->irq[i] = pci_irq_vector(handle->pdev, i + handle->rinfo.base_vector); --- base-commit: 7aaa8047eafd0bd628065b15757d9b48c5f9c07d change-id: 20260405-fixes-c71ff838a5f6 Best regards, -- Junrui Luo <moonafterrain@outlook.com>
|  |