Commit 63b1279d authored by Yufeng Mo's avatar Yufeng Mo Committed by David S. Miller
Browse files

net: hns3: check queue id range before using 



The input parameters may not be reliable. Before using the
queue id, we should check this parameter. Otherwise, memory
overwriting may occur.

Fixes: d3410018 ("net: hns3: refactor the mailbox message between PF and VF")
Signed-off-by: default avatarYufeng Mo <moyufeng@huawei.com>
Signed-off-by: default avatarGuangbin Huang <huangguangbin2@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 311c0aaa

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c

+8 −0
Original line number Diff line number Diff line
@@ -590,9 +590,17 @@ static void hclge_get_queue_id_in_pf(struct hclge_vport *vport, 
				     struct hclge_mbx_vf_to_pf_cmd *mbx_req,

				     struct hclge_respond_to_vf_msg *resp_msg)

{

	struct hnae3_handle *handle = &vport->nic;

	struct hclge_dev *hdev = vport->back;

	u16 queue_id, qid_in_pf;



	memcpy(&queue_id, mbx_req->msg.data, sizeof(queue_id));

	if (queue_id >= handle->kinfo.num_tqps) {

		dev_err(&hdev->pdev->dev, "Invalid queue id(%u) from VF %u\n",

			queue_id, mbx_req->mbx_src_vfid);

		return;

	}



	qid_in_pf = hclge_covert_handle_qid_global(&vport->nic, queue_id);

	memcpy(resp_msg->data, &qid_in_pf, sizeof(qid_in_pf));

	resp_msg->len = sizeof(qid_in_pf);