Commit 766fbcb3 authored by Yonglong Liu's avatar Yonglong Liu Committed by Jiantao Xiao
Browse files

net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs 

maillist inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8GVK7
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=53aba458f23846112c0d44239580ff59bc5c36c3



----------------------------------------------------------------------

The hns3 driver define an array of string to show the coalesce
info, but if the kernel adds a new mode or a new state,
out-of-bounds access may occur when coalesce info is read via
debugfs, this patch fix the problem.

Fixes: c99fead7 ("net: hns3: add debugfs support for interrupt coalesce")
Signed-off-by: default avatarYonglong Liu <liuyonglong@huawei.com>
Signed-off-by: default avatarJijie Shao <shaojijie@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarJiantao Xiao <xiaojiantao1@h-partners.com>
parent f4d0dd61

drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c

+6 −3
Original line number Diff line number Diff line
@@ -505,11 +505,14 @@ static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector, 
	}



	sprintf(result[j++], "%d", i);

	sprintf(result[j++], "%s", dim_state_str[dim->state]);

	sprintf(result[j++], "%s", dim->state < ARRAY_SIZE(dim_state_str) ?

		dim_state_str[dim->state] : "unknown");

	sprintf(result[j++], "%u", dim->profile_ix);

	sprintf(result[j++], "%s", dim_cqe_mode_str[dim->mode]);

	sprintf(result[j++], "%s", dim->mode < ARRAY_SIZE(dim_cqe_mode_str) ?

		dim_cqe_mode_str[dim->mode] : "unknown");

	sprintf(result[j++], "%s",

		dim_tune_stat_str[dim->tune_state]);

		dim->tune_state < ARRAY_SIZE(dim_tune_stat_str) ?

		dim_tune_stat_str[dim->tune_state] : "unknown");

	sprintf(result[j++], "%u", dim->steps_left);

	sprintf(result[j++], "%u", dim->steps_right);

	sprintf(result[j++], "%u", dim->tired);