From b32cbad2f211c27ac4f5849862e575ae82167f48 Mon Sep 17 00:00:00 2001 From: lipeng Date: Tue, 14 May 2019 20:41:23 +0800 Subject: [PATCH] set new value to resp_data_len if its value > HCLGE_MBX_MAX_RESP_DATA_SIZE driver inclusion category: bugfix bugzilla: NA CVE: NA If HCLGE_MBX_MAX_RESP_DATA_SIZE > HCLGE_MBX_MAX_RESP_DATA_SIZE, the memcpy will cause out of memory. Feature or Bugfix: Bugfix Signed-off-by: lipeng (Y) Reviewed-by: shenjian Reviewed-by: Yang Yingliang Signed-off-by: Yang Yingliang --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index a89ffd7ba9fb..b9765be9bd16 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -58,6 +58,10 @@ static int hclge_gen_resp_to_vf(struct hclge_vport *vport, "PF fail to gen resp to VF len %d exceeds max len %d\n", resp_data_len, HCLGE_MBX_MAX_RESP_DATA_SIZE); + /* If resp_data_len is too long, set the value to max length + * and return the msg to VF + */ + resp_data_len = HCLGE_MBX_MAX_RESP_DATA_SIZE; } hclge_cmd_setup_basic_desc(&desc, HCLGEVF_OPC_MBX_PF_TO_VF, false); -- GitLab