[ck] [PATCH openEuler v1 019/119] openeuler: net/hinic: fix the problem that memory leak

From: Shaozhengchao &lt;shaozhengchao(a)huawei.com&gt; commit 26da04d60ba8328f13549b905cf460d2a45ab53d openEuler-1.0 driver inclusion category:bugfix bugzilla:4472 CVE:NA ----------------------------------------------------------------------- fix the problem that memory leak Signed-off-by: Shaozhengchao &lt;shaozhengchao(a)huawei.com&gt; Reviewed-by: Chiqijun &lt;chiqijun(a)huawei.com&gt; Signed-off-by: Yang Yingliang &lt;yangyingliang(a)huawei.com&gt; Signed-off-by: Xin Hao &lt;haoxing990(a)gmail.com&gt; --- drivers/net/ethernet/huawei/hinic/hinic_dcb.c | 27 +++++++++++++++++++ .../net/ethernet/huawei/hinic/hinic_ethtool.c | 8 +++--- .../net/ethernet/huawei/hinic/hinic_mgmt.c | 14 ++++++++++ .../net/ethernet/huawei/hinic/hinic_mgmt.h | 3 +-- 4 files changed, 47 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_dcb.c b/drivers/net/ethernet/huawei/hinic/hinic_dcb.c index 1270620d0e1d..0cbdb7b7179f 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_dcb.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_dcb.c @@ -471,6 +471,9 @@ static void hinic_dcbnl_set_pg_tc_cfg_tx(struct net_device *netdev, int tc, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (tc > HINIC_DCB_TC_MAX - 1) + return; + if (prio != DCB_ATTR_VALUE_UNDEFINED) nic_dev->tmp_dcb_cfg.tc_cfg[tc].path[0].prio_type = prio; if (pg_id != DCB_ATTR_VALUE_UNDEFINED) @@ -488,6 +491,9 @@ static void hinic_dcbnl_set_pg_bwg_cfg_tx(struct net_device *netdev, int bwg_id, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (bwg_id > HINIC_DCB_PG_MAX - 1) + return; + nic_dev->tmp_dcb_cfg.bw_pct[0][bwg_id] = bw_pct; } @@ -497,6 +503,9 @@ static void hinic_dcbnl_set_pg_tc_cfg_rx(struct net_device *netdev, int tc, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (tc > HINIC_DCB_TC_MAX - 1) + return; + if (prio != DCB_ATTR_VALUE_UNDEFINED) nic_dev->tmp_dcb_cfg.tc_cfg[tc].path[1].prio_type = prio; if (pg_id != DCB_ATTR_VALUE_UNDEFINED) @@ -512,6 +521,9 @@ static void hinic_dcbnl_set_pg_bwg_cfg_rx(struct net_device *netdev, int bwg_id, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (bwg_id > HINIC_DCB_PG_MAX - 1) + return; + nic_dev->tmp_dcb_cfg.bw_pct[1][bwg_id] = bw_pct; } @@ -521,6 +533,9 @@ static void hinic_dcbnl_get_pg_tc_cfg_tx(struct net_device *netdev, int tc, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (tc > HINIC_DCB_TC_MAX - 1) + return; + *prio = nic_dev->dcb_cfg.tc_cfg[tc].path[0].prio_type; *pg_id = nic_dev->dcb_cfg.tc_cfg[tc].path[0].pg_id; *bw_pct = nic_dev->dcb_cfg.tc_cfg[tc].path[0].bw_pct; @@ -532,6 +547,9 @@ static void hinic_dcbnl_get_pg_bwg_cfg_tx(struct net_device *netdev, int bwg_id, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (bwg_id > HINIC_DCB_PG_MAX - 1) + return; + *bw_pct = nic_dev->dcb_cfg.bw_pct[0][bwg_id]; } @@ -541,6 +559,9 @@ static void hinic_dcbnl_get_pg_tc_cfg_rx(struct net_device *netdev, int tc, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (tc > HINIC_DCB_TC_MAX - 1) + return; + *prio = nic_dev->dcb_cfg.tc_cfg[tc].path[1].prio_type; *pg_id = nic_dev->dcb_cfg.tc_cfg[tc].path[1].pg_id; *bw_pct = nic_dev->dcb_cfg.tc_cfg[tc].path[1].bw_pct; @@ -552,6 +573,9 @@ static void hinic_dcbnl_get_pg_bwg_cfg_rx(struct net_device *netdev, int bwg_id, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (bwg_id > HINIC_DCB_PG_MAX - 1) + return; + *bw_pct = nic_dev->dcb_cfg.bw_pct[1][bwg_id]; } @@ -652,6 +676,9 @@ static void hinic_dcbnl_get_pfc_cfg(struct net_device *netdev, int prio, { struct hinic_nic_dev *nic_dev = netdev_priv(netdev); + if (prio > HINIC_DCB_TC_MAX - 1) + return; + *setting = nic_dev->dcb_cfg.tc_cfg[prio].pfc_en; } diff --git a/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c b/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c index 2ee5f57c0600..9c28fb66822d 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c @@ -1109,9 +1109,6 @@ static int hinic_set_channels(struct net_device *netdev, nic_dev->rss_limit, count); nic_dev->rss_limit = (u16)count; - /* Discard user configured rss */ - hinic_set_default_rss_indir(netdev); - if (netif_running(netdev)) { nicif_info(nic_dev, drv, netdev, "Restarting netdev\n"); err = hinic_close(netdev); @@ -1120,6 +1117,8 @@ static int hinic_set_channels(struct net_device *netdev, "Failed to close netdev\n"); return -EFAULT; } + /* Discard user configured rss */ + hinic_set_default_rss_indir(netdev); err = hinic_open(netdev); if (err) { @@ -1128,6 +1127,9 @@ static int hinic_set_channels(struct net_device *netdev, return -EFAULT; } } else { + /* Discard user configured rss */ + hinic_set_default_rss_indir(netdev); + hinic_update_num_qps(netdev); } diff --git a/drivers/net/ethernet/huawei/hinic/hinic_mgmt.c b/drivers/net/ethernet/huawei/hinic/hinic_mgmt.c index d1392fedb4f2..8706ef016ccb 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_mgmt.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_mgmt.c @@ -60,6 +60,8 @@ #define MAX_MSG_SZ 2016 +#define MAX_CMD_BUF_SIZE 2048ULL + #define MSG_SZ_IS_VALID(in_size) ((in_size) <= MAX_MSG_SZ) #define SYNC_MSG_ID(pf_to_mgmt) ((pf_to_mgmt)->sync_msg_id) @@ -312,6 +314,9 @@ static int send_msg_to_mgmt_async(struct hinic_msg_pf_to_mgmt *pf_to_mgmt, if (!hinic_get_chip_present_flag(pf_to_mgmt->hwdev)) return -EFAULT; + if (cmd_size > MAX_MSG_SZ) + return -EFAULT; + if (direction == HINIC_MSG_RESPONSE) prepare_header(pf_to_mgmt, &header, msg_len, mod, HINIC_MSG_ACK, direction, cmd, resp_msg_id); @@ -378,6 +383,9 @@ static int send_msg_to_mgmt_sync(struct hinic_msg_pf_to_mgmt *pf_to_mgmt, if (!hinic_get_chip_present_flag(pf_to_mgmt->hwdev)) return -EFAULT; + if (cmd_size > MAX_CMD_BUF_SIZE) + return -EFAULT; + if (direction == HINIC_MSG_RESPONSE) prepare_header(pf_to_mgmt, &header, msg_len, mod, ack_type, direction, cmd, resp_msg_id); @@ -935,6 +943,9 @@ int hinic_api_cmd_write_nack(void *hwdev, u8 dest, void *cmd, u16 size) if (!hwdev || !size || !cmd) return -EINVAL; + if (size > MAX_CMD_BUF_SIZE) + return -EINVAL; + if (!hinic_is_hwdev_mod_inited(hwdev, HINIC_HWDEV_MGMT_INITED) || hinic_get_mgmt_channel_status(hwdev)) return -EPERM; @@ -958,6 +969,9 @@ int hinic_api_cmd_read_ack(void *hwdev, u8 dest, void *cmd, u16 size, void *ack, if (!hwdev || !cmd || (ack_size && !ack)) return -EINVAL; + if (size > MAX_CMD_BUF_SIZE) + return -EINVAL; + if (!hinic_is_hwdev_mod_inited(hwdev, HINIC_HWDEV_MGMT_INITED) || hinic_get_mgmt_channel_status(hwdev)) return -EPERM; diff --git a/drivers/net/ethernet/huawei/hinic/hinic_mgmt.h b/drivers/net/ethernet/huawei/hinic/hinic_mgmt.h index 38f747004518..21318c895107 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_mgmt.h +++ b/drivers/net/ethernet/huawei/hinic/hinic_mgmt.h @@ -65,8 +65,7 @@ enum clp_reg_type { HINIC_CLP_READY_RSP_HOST = 4 }; #define HINIC_CLP_REG_GAP (0x20) -#define HINIC_CLP_INPUT_BUFFER_LEN_HOST (2048UL) -#define HINIC_CLP_OUTPUT_BUFFER_LEN_HOST (2048UL) +#define HINIC_CLP_INPUT_BUFFER_LEN_HOST (4096UL) #define HINIC_CLP_DATA_UNIT_HOST (4UL) #define HINIC_BAR01_GLOABAL_CTL_OFFSET (0x4000) -- 2.31.0