Commit dbc641ec authored by Dan Carpenter's avatar Dan Carpenter Committed by Leon Romanovsky
Browse files

RDMA/bnxt_re: Fix buffer overflow in debugfs code 



Add some bounds checking to prevent memory corruption in
bnxt_re_cc_config_set().  This is debugfs code so the bug can only be
triggered by root.

Fixes: 656dff55 ("RDMA/bnxt_re: Congestion control settings using debugfs hook")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/a6b081ab-55fe-4d0c-8f69-c5e5a59e9141@stanley.mountain


Acked-by: default avatarSelvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent 607a7dcf

drivers/infiniband/hw/bnxt_re/debugfs.c

+3 −0
Original line number Diff line number Diff line
@@ -285,6 +285,9 @@ static ssize_t bnxt_re_cc_config_set(struct file *filp, const char __user *buffe 
	u32 val;

	int rc;



	if (count >= sizeof(buf))

		return -EINVAL;



	if (copy_from_user(buf, buffer, count))

		return -EFAULT;