提交 b32cbad2 编写于 作者: L lipeng 提交者: Xie XiuQi

set new value to resp_data_len if its value > HCLGE_MBX_MAX_RESP_DATA_SIZE

driver inclusion
category: bugfix
bugzilla: NA
CVE: NA

If HCLGE_MBX_MAX_RESP_DATA_SIZE > HCLGE_MBX_MAX_RESP_DATA_SIZE,
the memcpy will cause out of memory.

Feature or Bugfix: Bugfix
Signed-off-by: Nlipeng (Y) <lipeng321@huawei.com>
Reviewed-by: Nshenjian <shenjian15@huawei.com>
Reviewed-by: NYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
上级 6dac6aee
...@@ -58,6 +58,10 @@ static int hclge_gen_resp_to_vf(struct hclge_vport *vport, ...@@ -58,6 +58,10 @@ static int hclge_gen_resp_to_vf(struct hclge_vport *vport,
"PF fail to gen resp to VF len %d exceeds max len %d\n", "PF fail to gen resp to VF len %d exceeds max len %d\n",
resp_data_len, resp_data_len,
HCLGE_MBX_MAX_RESP_DATA_SIZE); HCLGE_MBX_MAX_RESP_DATA_SIZE);
/* If resp_data_len is too long, set the value to max length
* and return the msg to VF
*/
resp_data_len = HCLGE_MBX_MAX_RESP_DATA_SIZE;
} }
hclge_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_MBX_PF_TO_VF, false); hclge_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_MBX_PF_TO_VF, false);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册