Skip to content

Commit 53aba45

Browse files
liuyonglong86davem330
authored andcommitted
net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
The hns3 driver define an array of string to show the coalesce info, but if the kernel adds a new mode or a new state, out-of-bounds access may occur when coalesce info is read via debugfs, this patch fix the problem. Fixes: c99fead ("net: hns3: add debugfs support for interrupt coalesce") Signed-off-by: Yonglong Liu <liuyonglong@huawei.com> Signed-off-by: Jijie Shao <shaojijie@huawei.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 75b247b commit 53aba45

1 file changed

Lines changed: 6 additions & 3 deletions

File tree

drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -503,11 +503,14 @@ static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector,
503503
}
504504

505505
sprintf(result[j++], "%d", i);
506-
sprintf(result[j++], "%s", dim_state_str[dim->state]);
506+
sprintf(result[j++], "%s", dim->state < ARRAY_SIZE(dim_state_str) ?
507+
dim_state_str[dim->state] : "unknown");
507508
sprintf(result[j++], "%u", dim->profile_ix);
508-
sprintf(result[j++], "%s", dim_cqe_mode_str[dim->mode]);
509+
sprintf(result[j++], "%s", dim->mode < ARRAY_SIZE(dim_cqe_mode_str) ?
510+
dim_cqe_mode_str[dim->mode] : "unknown");
509511
sprintf(result[j++], "%s",
510-
dim_tune_stat_str[dim->tune_state]);
512+
dim->tune_state < ARRAY_SIZE(dim_tune_stat_str) ?
513+
dim_tune_stat_str[dim->tune_state] : "unknown");
511514
sprintf(result[j++], "%u", dim->steps_left);
512515
sprintf(result[j++], "%u", dim->steps_right);
513516
sprintf(result[j++], "%u", dim->tired);

0 commit comments

Comments
 (0)