From 0c19807cba7fb4b02751670710e1a4d0ad718723 Mon Sep 17 00:00:00 2001 From: Chiqijun Date: Mon, 31 Aug 2020 20:41:47 +0800 Subject: [PATCH] net/hinic: Fix out-of-bounds access when setting ets driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- When the user mode tool sets ETS, the input value tc id exceeds the maximum value of 7, which will cause the array to be accessed out of bounds. Driver check the legality of tc id. Signed-off-by: Chiqijun Reviewed-by: Zengweiliang Signed-off-by: Yang Yingliang --- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index 740ec4adf6ba..04d40e60d8bb 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -769,8 +769,19 @@ int set_ets(struct hinic_nic_dev *nic_dev, void *buf_in, err = 0xff; goto exit; } - if (ets.flag_com.ets_flag.flag_ets_cos) + + if (ets.flag_com.ets_flag.flag_ets_cos) { + for (i = 0; i < HINIC_DCB_COS_MAX; i++) { + if (ets.tc[i] >= HINIC_DCB_TC_MAX) { + nicif_err(nic_dev, drv, nic_dev->netdev, + "ETS tc id %d out of range\n", + ets.tc[i]); + err = 0xFF; + goto exit; + } + } hinic_dcbnl_set_ets_tc_tool(nic_dev->netdev, ets.tc, true); + } if (ets.flag_com.ets_flag.flag_ets_percent) { for (i = support_tc; i < HINIC_DCB_TC_MAX; i++) { -- GitLab