net: hns3: fix vf id check issue when add flow director rule (0285dbae) · Commits · 戴 / test

When add flow director fule for vf, the vf id is used as array subscript before valid checking, which may cause memory overflow. Fixes: ("net: hns3: Add support for rule add/delete for flow director") Signed-off-by:

Jian Shen <shenjian15@huawei.com> Signed-off-by:

Peng Li <lipeng321@huawei.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c

+7 −7

Original line number	Diff line number	Diff line
		@@ -4677,6 +4677,13 @@ static int hclge_add_fd_entry(struct hnae3_handle *handle,
		u8 vf = ethtool_get_flow_spec_ring_vf(fs->ring_cookie);
		u16 tqps;

		if (vf > hdev->num_req_vfs) {
		dev_err(&hdev->pdev->dev,
		"Error: vf id (%d) > max vf num (%d)\n",
		vf, hdev->num_req_vfs);
		return -EINVAL;
		}

		dst_vport_id = vf ? hdev->vport[vf].vport_id : vport->vport_id;
		tqps = vf ? hdev->vport[vf].alloc_tqps : vport->alloc_tqps;

		@@ -4687,13 +4694,6 @@ static int hclge_add_fd_entry(struct hnae3_handle *handle,
		return -EINVAL;
		}

		if (vf > hdev->num_req_vfs) {
		dev_err(&hdev->pdev->dev,
		"Error: vf id (%d) > max vf num (%d)\n",
		vf, hdev->num_req_vfs);
		return -EINVAL;
		}

		action = HCLGE_FD_ACTION_ACCEPT_PACKET;
		q_index = ring;
		}

Admin message