net: hns3: add a check for tqp_index in hclge_get_ring_chain_from_mbx()

[ Upstream commit 326334aad024a60f46dc5e7dbe1efe32da3ca66f ]

The tqp_index is received from vf, if use it directly,
an out-of-bound issue may be caused, so add a check for
this tqp_index before using it in hclge_get_ring_chain_from_mbx().

Fixes: 84e095d64ed9 ("net: hns3: Change PF to add ring-vect binding & resetQ to mailbox")
Signed-off-by: Yufeng Mo <moyufeng@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
index 3ab6db2..c997c90 100644 (file)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -158,21 +158,31 @@ static int hclge_get_ring_chain_from_mbx(
                        struct hclge_vport *vport)
 {
        struct hnae3_ring_chain_node *cur_chain, *new_chain;
+       struct hclge_dev *hdev = vport->back;
        int ring_num;
-       int i = 0;
+       int i;
 
        ring_num = req->msg.ring_num;
 
        if (ring_num > HCLGE_MBX_MAX_RING_CHAIN_PARAM_NUM)
                return -ENOMEM;
 
+       for (i = 0; i < ring_num; i++) {
+               if (req->msg.param[i].tqp_index >= vport->nic.kinfo.rss_size) {
+                       dev_err(&hdev->pdev->dev, "tqp index(%u) is out of range(0-%u)\n",
+                               req->msg.param[i].tqp_index,
+                               vport->nic.kinfo.rss_size - 1);
+                       return -EINVAL;
+               }
+       }
+
        hnae3_set_bit(ring_chain->flag, HNAE3_RING_TYPE_B,
-                     req->msg.param[i].ring_type);
+                     req->msg.param[0].ring_type);
        ring_chain->tqp_index =
                hclge_get_queue_id(vport->nic.kinfo.tqp
-                                  [req->msg.param[i].tqp_index]);
+                                  [req->msg.param[0].tqp_index]);
        hnae3_set_field(ring_chain->int_gl_idx, HNAE3_RING_GL_IDX_M,
-                       HNAE3_RING_GL_IDX_S, req->msg.param[i].int_gl_index);
+                       HNAE3_RING_GL_IDX_S, req->msg.param[0].int_gl_index);
 
        cur_chain = ring_chain;