Commit 1c450bdf authored May 09, 2022 by Grant Grundler Committed by Greg Kroah-Hartman May 25, 2022

net: atlantic: verify hw_head_ lies within TX buffer ring



[ Upstream commit 2120b7f4d128433ad8c5f503a9584deba0684901 ]

Bounds check hw_head index provided by NIC to verify it lies
within the TX buffer ring.

Reported-by: Aashay Shringarpure <aashay@google.com>
Reported-by: Yi Chou <yich@google.com>
Reported-by: Shervin Oloumi <enlightened@google.com>
Signed-off-by: Grant Grundler <grundler@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent e5307704

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -674,6 +674,13 @@ static int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self,
		err = -ENXIO;
		goto err_exit;
		}

		/* Validate that the new hw_head_ is reasonable. */
		if (hw_head_ >= ring->size) {
		err = -ENXIO;
		goto err_exit;
		}

		ring->hw_head = hw_head_;
		err = aq_hw_err_from_flags(self);