net: atlantic: verify hw_head_ lies within TX buffer ring

stable inclusion
from stable-v5.10.118
commit 696292b9b5f66c8d3134c514af2c9387e5157d5f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5L686

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=696292b9b5f66c8d3134c514af2c9387e5157d5f

--------------------------------

[ Upstream commit 2120b7f4 ]

Bounds check hw_head index provided by NIC to verify it lies
within the TX buffer ring.
Reported-by: NAashay Shringarpure <aashay@google.com>
Reported-by: NYi Chou <yich@google.com>
Reported-by: NShervin Oloumi <enlightened@google.com>
Signed-off-by: NGrant Grundler <grundler@chromium.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Acked-by: NXie XiuQi <xiexiuqi@huawei.com>

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c

@@ -889,6 +889,13 @@ int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self,
 		err = -ENXIO;
 		goto err_exit;
 	}
+
+	/* Validate that the new hw_head_ is reasonable. */
+	if (hw_head_ >= ring->size) {
+		err = -ENXIO;
+		goto err_exit;
+	}
+
 	ring->hw_head = hw_head_;
 	err = aq_hw_err_from_flags(self);