diff options
| author | Jian Shen <shenjian15@huawei.com> | 2024-03-07 09:01:15 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2024-03-08 12:01:32 +0000 |
| commit | 4e2969a0d6a7549bc0bc1ebc990588b622c4443d (patch) | |
| tree | 26f3cf4b534863e3e0530c7a990756cc1509121d | |
| parent | 11d80f79dd9f871a52feba4bf24b5ac39f448eb7 (diff) | |
| download | nf-next-4e2969a0d6a7549bc0bc1ebc990588b622c4443d.tar.gz | |
net: hns3: add checking for vf id of mailbox
Add checking for vf id of mailbox, in order to avoid array
out-of-bounds risk.
Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index 4b0d07ca2505e3..d4a0e0be7a7230 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -1123,10 +1123,11 @@ void hclge_mbx_handler(struct hclge_dev *hdev) req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data; flag = le16_to_cpu(crq->desc[crq->next_to_use].flag); - if (unlikely(!hnae3_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B))) { + if (unlikely(!hnae3_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B) || + req->mbx_src_vfid > hdev->num_req_vfs)) { dev_warn(&hdev->pdev->dev, - "dropped invalid mailbox message, code = %u\n", - req->msg.code); + "dropped invalid mailbox message, code = %u, vfid = %u\n", + req->msg.code, req->mbx_src_vfid); /* dropping/not processing this invalid message */ crq->desc[crq->next_to_use].flag = 0; |