diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2025-02-07 12:16:19 +0300 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2025-02-09 04:58:22 -0500 |
| commit | dbc641ecf1cbd41a649e7ac6ea7175562ef599b2 (patch) | |
| tree | 53961a006a80ca3e3b3b4ca381ba4e739f8b0404 | |
| parent | 607a7dcf2e981449a4b200f497f8ea97ddb5e13f (diff) | |
RDMA/bnxt_re: Fix buffer overflow in debugfs code
Add some bounds checking to prevent memory corruption in
bnxt_re_cc_config_set(). This is debugfs code so the bug can only be
triggered by root.
Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/a6b081ab-55fe-4d0c-8f69-c5e5a59e9141@stanley.mountain
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
| -rw-r--r-- | drivers/infiniband/hw/bnxt_re/debugfs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c index f4dd2fb51867..d7354e7753fe 100644 --- a/drivers/infiniband/hw/bnxt_re/debugfs.c +++ b/drivers/infiniband/hw/bnxt_re/debugfs.c @@ -285,6 +285,9 @@ static ssize_t bnxt_re_cc_config_set(struct file *filp, const char __user *buffe u32 val; int rc; + if (count >= sizeof(buf)) + return -EINVAL; + if (copy_from_user(buf, buffer, count)) return -EFAULT; |