Commit 49c2547b authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'hns3-fixes' 



Huazhong Tan says:

====================
net: hns3: fixes for -net

The parameters sent from vf may be unreliable. If these
parameters are used directly, memory overwriting may occur.

So this series adds some checks for this case.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents eb4733d7 532cfc0d

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c

+7 −0
Original line number Diff line number Diff line
@@ -9813,12 +9813,19 @@ int hclge_reset_tqp(struct hnae3_handle *handle, u16 queue_id) 


void hclge_reset_vf_queue(struct hclge_vport *vport, u16 queue_id)

{

	struct hnae3_handle *handle = &vport->nic;

	struct hclge_dev *hdev = vport->back;

	int reset_try_times = 0;

	int reset_status;

	u16 queue_gid;

	int ret;



	if (queue_id >= handle->kinfo.num_tqps) {

		dev_warn(&hdev->pdev->dev, "Invalid vf queue id(%u)\n",

			 queue_id);

		return;

	}



	queue_gid = hclge_covert_handle_qid_global(&vport->nic, queue_id);



	ret = hclge_send_reset_tqp_cmd(hdev, queue_gid, true);

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c

+25 −4
Original line number Diff line number Diff line
@@ -158,21 +158,31 @@ static int hclge_get_ring_chain_from_mbx( 
			struct hclge_vport *vport)

{

	struct hnae3_ring_chain_node *cur_chain, *new_chain;

	struct hclge_dev *hdev = vport->back;

	int ring_num;

	int i = 0;

	int i;



	ring_num = req->msg.ring_num;



	if (ring_num > HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM)

		return -ENOMEM;



	for (i = 0; i < ring_num; i++) {

		if (req->msg.param[i].tqp_index >= vport->nic.kinfo.rss_size) {

			dev_err(&hdev->pdev->dev, "tqp index(%u) is out of range(0-%u)\n",

				req->msg.param[i].tqp_index,

				vport->nic.kinfo.rss_size - 1);

			return -EINVAL;

		}

	}



	hnae3_set_bit(ring_chain->flag, HNAE3_RING_TYPE_B,

		      req->msg.param[i].ring_type);

		      req->msg.param[0].ring_type);

	ring_chain->tqp_index =

		hclge_get_queue_id(vport->nic.kinfo.tqp

				   [req->msg.param[i].tqp_index]);

				   [req->msg.param[0].tqp_index]);

	hnae3_set_field(ring_chain->int_gl_idx, HNAE3_RING_GL_IDX_M,

			HNAE3_RING_GL_IDX_S, req->msg.param[i].int_gl_index);

			HNAE3_RING_GL_IDX_S, req->msg.param[0].int_gl_index);



	cur_chain = ring_chain;
@@ -597,6 +607,17 @@ static void hclge_get_rss_key(struct hclge_vport *vport, 


	index = mbx_req->msg.data[0];



	/* Check the query index of rss_hash_key from VF, make sure no

	 * more than the size of rss_hash_key.

	 */

	if (((index + 1) * HCLGE_RSS_MBX_RESP_LEN) >

	      sizeof(vport[0].rss_hash_key)) {

		dev_warn(&hdev->pdev->dev,

			 "failed to get the rss hash key, the index(%u) invalid !\n",

			 index);

		return;

	}



	memcpy(resp_msg->data,

	       &hdev->vport[0].rss_hash_key[index * HCLGE_RSS_MBX_RESP_LEN],

	       HCLGE_RSS_MBX_RESP_LEN);