Commit 9094b5aa authored by Peiyang Wang's avatar Peiyang Wang Committed by Hao Chen
Browse files

net: hns3: void array out of bound when loop tnl_num 

maillist inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAN3KC
CVE: NA

Reference: https://lore.kernel.org/all/20240813141024.1707252-5-shaojijie@huawei.com/



----------------------------------------------------------------------

When query reg inf of SSU, it loops tnl_num times. However, tnl_num comes
from hardware and the length of array is a fixed value. To void array out
of bound, make sure the loop time is not greater than the length of array

Fixes: 48c6a9ff ("net: hns3: dump more reg info based on ras mod")
Signed-off-by: default avatarPeiyang Wang <wangpeiyang1@huawei.com>
Signed-off-by: default avatarJijie Shao <shaojijie@huawei.com>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
parent b06482c4

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c

+3 −3
Original line number Diff line number Diff line
@@ -1598,8 +1598,7 @@ static void hclge_query_reg_info_of_ssu(struct hclge_dev *hdev) 
{

	u32 loop_para[HCLGE_MOD_MSG_PARA_ARRAY_MAX_SIZE] = {0};

	struct hclge_mod_reg_common_msg msg;

	u8 i, j, num;

	u32 loop_time;

	u8 i, j, num, loop_time;



	num = ARRAY_SIZE(hclge_ssu_reg_common_msg);

	for (i = 0; i < num; i++) {
@@ -1609,7 +1608,8 @@ static void hclge_query_reg_info_of_ssu(struct hclge_dev *hdev) 
		loop_time = 1;

		loop_para[0] = 0;

		if (msg.need_para) {

			loop_time = hdev->ae_dev->dev_specs.tnl_num;

			loop_time = min_t(u8, hdev->ae_dev->dev_specs.tnl_num,

					  HCLGE_MOD_MSG_PARA_ARRAY_MAX_SIZE);

			for (j = 0; j < loop_time; j++)

				loop_para[j] = j + 1;

		}