From 0e5b827e6b97ca89033f9b086e0920230b34abb5 Mon Sep 17 00:00:00 2001 From: Chiqijun Date: Tue, 25 Aug 2020 11:23:49 +0800 Subject: [PATCH] net/hinic: Fix out-of-bounds access when setting ets driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- When the user mode tool sets ETS, the input value tc id exceeds the maximum value of 7, which will cause the array to be accessed out of bounds. Driver check the legality of tc id. Signed-off-by: Chiqijun Reviewed-by: Zengweiliang Signed-off-by: Yang Yingliang --- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index 740ec4adf6ba..04d40e60d8bb 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -769,8 +769,19 @@ int set_ets(struct hinic_nic_dev *nic_dev, void *buf_in, err = 0xff; goto exit; } - if (ets.flag_com.ets_flag.flag_ets_cos) + + if (ets.flag_com.ets_flag.flag_ets_cos) { + for (i = 0; i < HINIC_DCB_COS_MAX; i++) { + if (ets.tc[i] >= HINIC_DCB_TC_MAX) { + nicif_err(nic_dev, drv, nic_dev->netdev, + "ETS tc id %d out of range\n", + ets.tc[i]); + err = 0xFF; + goto exit; + } + } hinic_dcbnl_set_ets_tc_tool(nic_dev->netdev, ets.tc, true); + } if (ets.flag_com.ets_flag.flag_ets_percent) { for (i = support_tc; i < HINIC_DCB_TC_MAX; i++) { -- GitLab