Commit 326334aa authored by Yufeng Mo's avatar Yufeng Mo Committed by David S. Miller
Browse files

net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx() 



The tqp_index is received from vf, if use it directly,
an out-of-bound issue may be caused, so add a check for
this tqp_index before using it in hclge_get_ring_chain_from_mbx().

Fixes: 84e095d6 ("net: hns3: Change PF to add ring-vect binding & resetQ to mailbox")
Signed-off-by: default avatarYufeng Mo <moyufeng@huawei.com>
Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 67a69f84

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c

+14 −4
Original line number Diff line number Diff line
@@ -158,21 +158,31 @@ static int hclge_get_ring_chain_from_mbx( 
			struct hclge_vport *vport)

{

	struct hnae3_ring_chain_node *cur_chain, *new_chain;

	struct hclge_dev *hdev = vport->back;

	int ring_num;

	int i = 0;

	int i;



	ring_num = req->msg.ring_num;



	if (ring_num > HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM)

		return -ENOMEM;



	for (i = 0; i < ring_num; i++) {

		if (req->msg.param[i].tqp_index >= vport->nic.kinfo.rss_size) {

			dev_err(&hdev->pdev->dev, "tqp index(%u) is out of range(0-%u)\n",

				req->msg.param[i].tqp_index,

				vport->nic.kinfo.rss_size - 1);

			return -EINVAL;

		}

	}



	hnae3_set_bit(ring_chain->flag, HNAE3_RING_TYPE_B,

		      req->msg.param[i].ring_type);

		      req->msg.param[0].ring_type);

	ring_chain->tqp_index =

		hclge_get_queue_id(vport->nic.kinfo.tqp

				   [req->msg.param[i].tqp_index]);

				   [req->msg.param[0].tqp_index]);

	hnae3_set_field(ring_chain->int_gl_idx, HNAE3_RING_GL_IDX_M,

			HNAE3_RING_GL_IDX_S, req->msg.param[i].int_gl_index);

			HNAE3_RING_GL_IDX_S, req->msg.param[0].int_gl_index);



	cur_chain = ring_chain;