net: hns3: add checking for vf id of mailbox

Add checking for vf id of mailbox, in order to avoid array
out-of-bounds risk.

Signed-off-by: Jian Shen <shenjian15@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Reviewed-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
index 4b0d07ca2505e3adfeb4afcbbae502457a4ac3db..d4a0e0be7a7230054d4e523ec463a16f52b9592e 100644 (file)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c
@@ -1123,10 +1123,11 @@ void hclge_mbx_handler(struct hclge_dev *hdev)
                req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data;
 
                flag = le16_to_cpu(crq->desc[crq->next_to_use].flag);
-               if (unlikely(!hnae3_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B))) {
+               if (unlikely(!hnae3_get_bit(flag, HCLGE_CMDQ_RX_OUTVLD_B) ||
+                            req->mbx_src_vfid > hdev->num_req_vfs)) {
                        dev_warn(&hdev->pdev->dev,
-                                "dropped invalid mailbox message, code = %u\n",
-                                req->msg.code);
+                                "dropped invalid mailbox message, code = %u, vfid = %u\n",
+                                req->msg.code, req->mbx_src_vfid);
 
                        /* dropping/not processing this invalid message */
                        crq->desc[crq->next_to_use].flag = 0;