Commit 437a50bd authored by Yonglong Liu's avatar Yonglong Liu Committed by Wei Li
Browse files

net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs 

mainline inclusion
from mainline-v6.7-rc2
commit 53aba458f23846112c0d44239580ff59bc5c36c3
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFNY
CVE: CVE-2023-52807

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=53aba458f23846112c0d44239580ff59bc5c36c3



--------------------------------

The hns3 driver define an array of string to show the coalesce
info, but if the kernel adds a new mode or a new state,
out-of-bounds access may occur when coalesce info is read via
debugfs, this patch fix the problem.

Fixes: c99fead7 ("net: hns3: add debugfs support for interrupt coalesce")
Signed-off-by: default avatarYonglong Liu <liuyonglong@huawei.com>
Signed-off-by: default avatarJijie Shao <shaojijie@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarWei Li <liwei391@huawei.com>
parent 40b951d0

drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c

+6 −3
Original line number Diff line number Diff line
@@ -484,11 +484,14 @@ static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector, 
	}



	sprintf(result[j++], "%d", i);

	sprintf(result[j++], "%s", dim_state_str[dim->state]);

	sprintf(result[j++], "%s", dim->state < ARRAY_SIZE(dim_state_str) ?

		dim_state_str[dim->state] : "unknown");

	sprintf(result[j++], "%u", dim->profile_ix);

	sprintf(result[j++], "%s", dim_cqe_mode_str[dim->mode]);

	sprintf(result[j++], "%s", dim->mode < ARRAY_SIZE(dim_cqe_mode_str) ?

		dim_cqe_mode_str[dim->mode] : "unknown");

	sprintf(result[j++], "%s",

		dim_tune_stat_str[dim->tune_state]);

		dim->tune_state < ARRAY_SIZE(dim_tune_stat_str) ?

		dim_tune_stat_str[dim->tune_state] : "unknown");

	sprintf(result[j++], "%u", dim->steps_left);

	sprintf(result[j++], "%u", dim->steps_right);

	sprintf(result[j++], "%u", dim->tired);