Commit 9a0b45fd authored Apr 24, 2022 by Jian Shen Committed by Greg Kroah-Hartman May 12, 2022

net: hns3: add validity check for message data length



[ Upstream commit 7d413735cb18ff73aaba3457b16b08332e8d3cc4 ]

Add validity check for message data length in function
hclge_send_mbx_msg(), avoid unexpected overflow.

Fixes: dde1a86e ("net: hns3: Add mailbox support to PF driver")
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Guangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent aa7d6ea2

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -60,6 +60,13 @@ static int hclge_send_mbx_msg(struct hclge_vport vport, u8 msg, u16 msg_len,
		enum hclge_cmd_status status;
		struct hclge_desc desc;

		if (msg_len > HCLGE_MBX_MAX_MSG_SIZE) {
		dev_err(&hdev->pdev->dev,
		"msg data length(=%u) exceeds maximum(=%u)\n",
		msg_len, HCLGE_MBX_MAX_MSG_SIZE);
		return -EMSGSIZE;
		}

		resp_pf_to_vf = (struct hclge_mbx_pf_to_vf_cmd *)desc.data;

		hclge_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_MBX_PF_TO_VF, false);