[ck] [PATCH openEuler v1 016/119] openeuler: net: hinic: fixes dbgtool bugs

From: Shaozhengchao <shaozhengchao(a)huawei.com> commit 6a6643134e96b159cccb969892a1ab67193ed402 openEuler-1.0 driver inclusion category:bugfix bugzilla:4472 CVE:NA ----------------------------------------------------------------------- The patch fixes dbgtool bugs. Signed-off-by: Shaozhengchao <shaozhengchao(a)huawei.com> Reviewed-by: Xuechaojing <xuechaojing(a)huawei.com> Reviewed-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Xin Hao <haoxing990(a)gmail.com> --- drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c | 8 ++++---- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c b/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c index 0cf65bfde2de..49be3e06e526 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c @@ -180,8 +180,8 @@ long dbgtool_knl_api_cmd_read(struct dbgtool_param *para, /* alloc cmd and ack memory*/ size = para->param.api_rd.size; - if (para->param.api_rd.size == 0) { - pr_err("Read cmd size invalid\n"); + if (para->param.api_rd.size == 0 || size > DBGTOOL_MSG_MAX_SIZE) { + pr_err("Read cmd size invalid or more than 2M\n"); return -EINVAL; } cmd = kzalloc((unsigned long long)size, GFP_KERNEL); @@ -260,8 +260,8 @@ long dbgtool_knl_api_cmd_write(struct dbgtool_param *para, /* alloc cmd memory*/ size = para->param.api_wr.size; - if (para->param.api_wr.size == 0) { - pr_err("Write cmd size invalid\n"); + if (para->param.api_wr.size == 0 || size > DBGTOOL_MSG_MAX_SIZE) { + pr_err("Write cmd size invalid or more than 2M\n"); return -EINVAL; } cmd = kzalloc((unsigned long long)size, GFP_KERNEL); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index d4a146413208..f82e2be947ee 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -1337,8 +1337,8 @@ static int get_pf_dev_info(char *dev_name, struct msg_module *nt_msg) int i; int err; - if (nt_msg->lenInfo.outBuffLen != (sizeof(dev_info) * 16) || - nt_msg->lenInfo.inBuffLen != (sizeof(dev_info) * 16)) { + if (nt_msg->lenInfo.outBuffLen != sizeof(dev_info) || + nt_msg->lenInfo.inBuffLen != sizeof(dev_info)) { pr_err("Invalid out_buf_size %d or Invalid in_buf_size %d, expect %lu\n", nt_msg->lenInfo.outBuffLen, nt_msg->lenInfo.inBuffLen, (sizeof(dev_info) * 16)); -- 2.31.0