net: hns3: fix memory override when bd_num is bigger than the ring size

driver inclusion
category: bugfix
bugzilla: NA
CVE: NA

----------------------------

The bd_num is from firmware, it may be bigger than the ring
size, and may cause memory override problem.
Signed-off-by: NYonglong Liu <liuyonglong@huawei.com>
Reviewed-by: NJunxin Chen <chenjunxin1@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>

drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_port.c

@@ -88,6 +88,12 @@ int hns3_get_port_info(const struct hns3_nic_priv *net_priv,
 	desc_data = (__le32 *)(&desc.data[0]);
 	bd_num = le32_to_cpu(*desc_data);
 
+	if (bd_num > hdev->hw.cmq.csq.desc_num) {
+		dev_err(&hdev->pdev->dev, "get invalid BD num %u(max %u)\n",
+			bd_num, hdev->hw.cmq.csq.desc_num);
+		return -EINVAL;
+	}
+
 	port_desc = kcalloc(bd_num, sizeof(struct hclge_desc), GFP_KERNEL);
 	if (ZERO_OR_NULL_PTR(port_desc))
 		return -ENOMEM;