diff mbox series

[3/6] net/bnxt: avoid potential out of bounds read

Message ID 20200303175938.14292-4-stephen@networkplumber.org (mailing list archive)
State Changes Requested, archived
Delegated to: Ajit Khaparde
Headers
Series net/bnxt: bounds checking patches |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Stephen Hemminger March 3, 2020, 5:59 p.m. UTC 
  If hardware returned a bogus number of vnic's  from the
query it could cause an out of bounds read into vnic table.

Reported-by: Christopher Ertl <Christopher.Ertl@microsoft.com>
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 drivers/net/bnxt/bnxt_hwrm.c | 6 ++++++
 1 file changed, 6 insertions(+)
diff mbox series

Patch

diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 20e2f6a36713..ad8bdb1c2913 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -4029,6 +4029,12 @@  static int bnxt_hwrm_func_vf_vnic_query(struct bnxt *bp, uint16_t vf,
 
 	HWRM_UNLOCK();
 
+	if (rc > bp->pf.total_vnics) {
+		PMD_DRV_LOG(ERR,
+			    "Vnic id %d is out of range\n", rc);
+		return -EINVAL;
+	}
+
 	return rc;
 }