From 6a6643134e96b159cccb969892a1ab67193ed402 Mon Sep 17 00:00:00 2001 From: Shaozhengchao Date: Thu, 26 Sep 2019 20:30:46 +0800 Subject: [PATCH] net: hinic: fixes dbgtool bugs driver inclusion category:bugfix bugzilla:4472 CVE:NA ----------------------------------------------------------------------- The patch fixes dbgtool bugs. Signed-off-by: Shaozhengchao Reviewed-by: Xuechaojing Reviewed-by: Yang Yingliang Signed-off-by: Yang Yingliang --- drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c | 8 ++++---- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c b/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c index 0cf65bfde2de..49be3e06e526 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c @@ -180,8 +180,8 @@ long dbgtool_knl_api_cmd_read(struct dbgtool_param *para, /* alloc cmd and ack memory*/ size = para->param.api_rd.size; - if (para->param.api_rd.size == 0) { - pr_err("Read cmd size invalid\n"); + if (para->param.api_rd.size == 0 || size > DBGTOOL_MSG_MAX_SIZE) { + pr_err("Read cmd size invalid or more than 2M\n"); return -EINVAL; } cmd = kzalloc((unsigned long long)size, GFP_KERNEL); @@ -260,8 +260,8 @@ long dbgtool_knl_api_cmd_write(struct dbgtool_param *para, /* alloc cmd memory*/ size = para->param.api_wr.size; - if (para->param.api_wr.size == 0) { - pr_err("Write cmd size invalid\n"); + if (para->param.api_wr.size == 0 || size > DBGTOOL_MSG_MAX_SIZE) { + pr_err("Write cmd size invalid or more than 2M\n"); return -EINVAL; } cmd = kzalloc((unsigned long long)size, GFP_KERNEL); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index d4a146413208..f82e2be947ee 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -1337,8 +1337,8 @@ static int get_pf_dev_info(char *dev_name, struct msg_module *nt_msg) int i; int err; - if (nt_msg->lenInfo.outBuffLen != (sizeof(dev_info) * 16) || - nt_msg->lenInfo.inBuffLen != (sizeof(dev_info) * 16)) { + if (nt_msg->lenInfo.outBuffLen != sizeof(dev_info) || + nt_msg->lenInfo.inBuffLen != sizeof(dev_info)) { pr_err("Invalid out_buf_size %d or Invalid in_buf_size %d, expect %lu\n", nt_msg->lenInfo.outBuffLen, nt_msg->lenInfo.inBuffLen, (sizeof(dev_info) * 16)); -- GitLab