Commit 2120b7f4 authored by Grant Grundler's avatar Grant Grundler Committed by David S. Miller
Browse files

net: atlantic: verify hw_head_ lies within TX buffer ring 



Bounds check hw_head index provided by NIC to verify it lies
within the TX buffer ring.

Reported-by: default avatarAashay Shringarpure <aashay@google.com>
Reported-by: default avatarYi Chou <yich@google.com>
Reported-by: default avatarShervin Oloumi <enlightened@google.com>
Signed-off-by: default avatarGrant Grundler <grundler@chromium.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6aecbba1

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c

+7 −0
Original line number Diff line number Diff line
@@ -889,6 +889,13 @@ int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self, 
		err = -ENXIO;

		goto err_exit;

	}



	/* Validate that the new hw_head_ is reasonable. */

	if (hw_head_ >= ring->size) {

		err = -ENXIO;

		goto err_exit;

	}



	ring->hw_head = hw_head_;

	err = aq_hw_err_from_flags(self);