Commit 53aba458 authored by Yonglong Liu's avatar Yonglong Liu Committed by David S. Miller

net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs

The hns3 driver define an array of string to show the coalesce
info, but if the kernel adds a new mode or a new state,
out-of-bounds access may occur when coalesce info is read via
debugfs, this patch fix the problem.

Fixes: c99fead7 ("net: hns3: add debugfs support for interrupt coalesce")
Signed-off-by: default avatarYonglong Liu <liuyonglong@huawei.com>
Signed-off-by: default avatarJijie Shao <shaojijie@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 75b247b5
...@@ -503,11 +503,14 @@ static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector, ...@@ -503,11 +503,14 @@ static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector,
} }
sprintf(result[j++], "%d", i); sprintf(result[j++], "%d", i);
sprintf(result[j++], "%s", dim_state_str[dim->state]); sprintf(result[j++], "%s", dim->state < ARRAY_SIZE(dim_state_str) ?
dim_state_str[dim->state] : "unknown");
sprintf(result[j++], "%u", dim->profile_ix); sprintf(result[j++], "%u", dim->profile_ix);
sprintf(result[j++], "%s", dim_cqe_mode_str[dim->mode]); sprintf(result[j++], "%s", dim->mode < ARRAY_SIZE(dim_cqe_mode_str) ?
dim_cqe_mode_str[dim->mode] : "unknown");
sprintf(result[j++], "%s", sprintf(result[j++], "%s",
dim_tune_stat_str[dim->tune_state]); dim->tune_state < ARRAY_SIZE(dim_tune_stat_str) ?
dim_tune_stat_str[dim->tune_state] : "unknown");
sprintf(result[j++], "%u", dim->steps_left); sprintf(result[j++], "%u", dim->steps_left);
sprintf(result[j++], "%u", dim->steps_right); sprintf(result[j++], "%u", dim->steps_right);
sprintf(result[j++], "%u", dim->tired); sprintf(result[j++], "%u", dim->tired);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment