net: hinic: fixes dbgtool bugs

driver inclusion
category:bugfix
bugzilla:4472
CVE:NA

-----------------------------------------------------------------------

The patch fixes dbgtool bugs.
Signed-off-by: NShaozhengchao <shaozhengchao@huawei.com>
Reviewed-by: NXuechaojing <xuechaojing@huawei.com>
Reviewed-by: NYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>

drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c

@@ -180,8 +180,8 @@ long dbgtool_knl_api_cmd_read(struct dbgtool_param *para,
 
 	/* alloc cmd and ack memory*/
 	size = para->param.api_rd.size;
-	if (para->param.api_rd.size == 0) {
-		pr_err("Read cmd size invalid\n");
+	if (para->param.api_rd.size == 0 || size > DBGTOOL_MSG_MAX_SIZE) {
+		pr_err("Read cmd size invalid or more than 2M\n");
 		return -EINVAL;
 	}
 	cmd = kzalloc((unsigned long long)size, GFP_KERNEL);
@@ -260,8 +260,8 @@ long dbgtool_knl_api_cmd_write(struct dbgtool_param *para,
 
 	/* alloc cmd memory*/
 	size = para->param.api_wr.size;
-	if (para->param.api_wr.size == 0) {
-		pr_err("Write cmd size invalid\n");
+	if (para->param.api_wr.size == 0 || size > DBGTOOL_MSG_MAX_SIZE) {
+		pr_err("Write cmd size invalid or more than 2M\n");
 		return -EINVAL;
 	}
 	cmd = kzalloc((unsigned long long)size, GFP_KERNEL);

drivers/net/ethernet/huawei/hinic/hinic_nictool.c

@@ -1337,8 +1337,8 @@ static int get_pf_dev_info(char *dev_name, struct msg_module *nt_msg)
 	int i;
 	int err;
 
-	if (nt_msg->lenInfo.outBuffLen != (sizeof(dev_info) * 16) ||
-	    nt_msg->lenInfo.inBuffLen != (sizeof(dev_info) * 16)) {
+	if (nt_msg->lenInfo.outBuffLen != sizeof(dev_info) ||
+	    nt_msg->lenInfo.inBuffLen != sizeof(dev_info)) {
 		pr_err("Invalid out_buf_size %d or Invalid in_buf_size %d, expect %lu\n",
 		       nt_msg->lenInfo.outBuffLen, nt_msg->lenInfo.inBuffLen,
 		       (sizeof(dev_info) * 16));