Commit a6b38ca3 authored by Jian Shen's avatar Jian Shen Committed by Jiantao Xiao
Browse files

net: hns3: add checking for vf id of mailbox 

mainline inclusion
from mainline-v6.9-rc1
commit 4e2969a0d6a7549bc0bc1ebc990588b622c4443d
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I98TUP
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4e2969a0d6a7549bc0bc1ebc990588b622c4443d



----------------------------------------------------------------------

Add checking for vf id of mailbox, in order to avoid array
out-of-bounds risk.

Signed-off-by: default avatarJian Shen <shenjian15@huawei.com>
Signed-off-by: default avatarJijie Shao <shaojijie@huawei.com>
Reviewed-by: default avatarSunil Goutham <sgoutham@marvell.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarJiantao Xiao <xiaojiantao1@h-partners.com>
parent 5f45799c

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c

+4 −3
Original line number Diff line number Diff line
@@ -1123,10 +1123,11 @@ void hclge_mbx_handler(struct hclge_dev *hdev) 
		req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data;



		flag = le16_to_cpu(crq->desc[crq->next_to_use].flag);

		if (unlikely(!hnae3_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B))) {

		if (unlikely(!hnae3_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B) ||

			     req->mbx_src_vfid > hdev->num_req_vfs)) {

			dev_warn(&hdev->pdev->dev,

				 "dropped invalid mailbox message, code = %u\n",

				 req->msg.code);

				 "dropped invalid mailbox message, code = %u, vfid = %u\n",

				 req->msg.code, req->mbx_src_vfid);



			/* dropping/not processing this invalid message */

			crq->desc[crq->next_to_use].flag = 0;