Commit 2120b7f4 authored by Grant Grundler's avatar Grant Grundler Committed by David S. Miller

net: atlantic: verify hw_head_ lies within TX buffer ring

Bounds check hw_head index provided by NIC to verify it lies
within the TX buffer ring.
Reported-by: default avatarAashay Shringarpure <aashay@google.com>
Reported-by: default avatarYi Chou <yich@google.com>
Reported-by: default avatarShervin Oloumi <enlightened@google.com>
Signed-off-by: default avatarGrant Grundler <grundler@chromium.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6aecbba1
...@@ -889,6 +889,13 @@ int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self, ...@@ -889,6 +889,13 @@ int hw_atl_b0_hw_ring_tx_head_update(struct aq_hw_s *self,
err = -ENXIO; err = -ENXIO;
goto err_exit; goto err_exit;
} }
/* Validate that the new hw_head_ is reasonable. */
if (hw_head_ >= ring->size) {
err = -ENXIO;
goto err_exit;
}
ring->hw_head = hw_head_; ring->hw_head = hw_head_;
err = aq_hw_err_from_flags(self); err = aq_hw_err_from_flags(self);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment