net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs

[ Upstream commit 53aba458f23846112c0d44239580ff59bc5c36c3 ]

The hns3 driver define an array of string to show the coalesce
info, but if the kernel adds a new mode or a new state,
out-of-bounds access may occur when coalesce info is read via
debugfs, this patch fix the problem.

Fixes: c99fead7cb07 ("net: hns3: add debugfs support for interrupt coalesce")
Signed-off-by: Yonglong Liu <liuyonglong@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
index b850853..4f385a1 100644 (file)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
@@ -500,11 +500,14 @@ static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector,
        }
 
        sprintf(result[j++], "%d", i);
-       sprintf(result[j++], "%s", dim_state_str[dim->state]);
+       sprintf(result[j++], "%s", dim->state < ARRAY_SIZE(dim_state_str) ?
+               dim_state_str[dim->state] : "unknown");
        sprintf(result[j++], "%u", dim->profile_ix);
-       sprintf(result[j++], "%s", dim_cqe_mode_str[dim->mode]);
+       sprintf(result[j++], "%s", dim->mode < ARRAY_SIZE(dim_cqe_mode_str) ?
+               dim_cqe_mode_str[dim->mode] : "unknown");
        sprintf(result[j++], "%s",
-               dim_tune_stat_str[dim->tune_state]);
+               dim->tune_state < ARRAY_SIZE(dim_tune_stat_str) ?
+               dim_tune_stat_str[dim->tune_state] : "unknown");
        sprintf(result[j++], "%u", dim->steps_left);
        sprintf(result[j++], "%u", dim->steps_right);
        sprintf(result[j++], "%u", dim->tired);