diff options
| author | Dan Carpenter <[email protected]> | 2025-02-07 09:16:19 +0000 |
|---|---|---|
| committer | Leon Romanovsky <[email protected]> | 2025-02-09 09:58:22 +0000 |
| commit | dbc641ecf1cbd41a649e7ac6ea7175562ef599b2 (patch) | |
| tree | 53961a006a80ca3e3b3b4ca381ba4e739f8b0404 | |
| parent | RDMA/mana_ib: Fix error code in probe() (diff) | |
| download | kernel-dbc641ecf1cbd41a649e7ac6ea7175562ef599b2.tar.gz kernel-dbc641ecf1cbd41a649e7ac6ea7175562ef599b2.zip | |
RDMA/bnxt_re: Fix buffer overflow in debugfs code
Add some bounds checking to prevent memory corruption in
bnxt_re_cc_config_set(). This is debugfs code so the bug can only be
triggered by root.
Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook")
Signed-off-by: Dan Carpenter <[email protected]>
Link: https://patch.msgid.link/[email protected]
Acked-by: Selvin Xavier <[email protected]>
Signed-off-by: Leon Romanovsky <[email protected]>
| -rw-r--r-- | drivers/infiniband/hw/bnxt_re/debugfs.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c index f4dd2fb51867..d7354e7753fe 100644 --- a/drivers/infiniband/hw/bnxt_re/debugfs.c +++ b/drivers/infiniband/hw/bnxt_re/debugfs.c @@ -285,6 +285,9 @@ static ssize_t bnxt_re_cc_config_set(struct file *filp, const char __user *buffe u32 val; int rc; + if (count >= sizeof(buf)) + return -EINVAL; + if (copy_from_user(buf, buffer, count)) return -EFAULT; |