sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-07-02 20:10:19 +03:00
Code Issues Packages Projects Releases Wiki Activity

[bnxt] Prevent out-of-bounds memory access

Browse Source 
Add boundary checks to prevent out-of-bounds memory accesses in RX and
HWRM paths.

Signed-off-by: Joseph Wong <joseph.wong@broadcom.com>
This commit is contained in:
Joseph Wong
2026-06-22 10:11:56 +01:00
committed by Michael Brown
parent d75a9670be
commit 781b8d616f
1 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/drivers/net/bnxt/bnxt.c
+10 -7
View File
@@ -467,7 +467,7 @@ void bnxt_rx_process ( struct net_device *dev, struct bnxt *bp,
struct rx_pkt_cmpl *rx_cmp,
struct rx_pkt_cmpl_hi *rx_cmp_hi )
{
u32 desc_idx = rx_cmp->opaque;
u32 desc_idx = rx_cmp->opaque & ( NUM_RX_BUFFERS - 1 );
struct io_buffer *iob = bp->rx.iob[desc_idx];
u8 drop;
@@ -711,12 +711,15 @@ static int wait_resp ( struct bnxt *bp, u32 tmo, u16 len, const char *func )
for ( idx = 0; idx < wait_cnt; idx++ ) {
resp_len = resp->resp_len;
if ( resp->seq_id == req->seq_id &&
resp->req_type == req->req_type &&
ptr[resp_len - 1] == 1 ) {
bp->last_resp_code = resp->error_code;
ret = resp->error_code;
break;
if ( resp_len != 0 && resp_len <= ( u16 ) RESP_BUFFER_SIZE ) {
if ( resp->seq_id == req->seq_id &&
resp->req_type == req->req_type &&
ptr[resp_len - 1] == 1 ) {
bp->last_resp_code = resp->error_code;
ret = resp->error_code;
break;
}
}
udelay ( HWRM_CMD_POLL_WAIT_TIME );
}