net: hns3: void array out of bound when loop tnl_num

When query reg inf of SSU, it loops tnl_num times. However, tnl_num comes
from hardware and the length of array is a fixed value. To void array out
of bound, make sure the loop time is not greater than the length of array

Signed-off-by: Peiyang Wang <wangpeiyang1@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
index e132c2f09560984139c8089635272099cfb290d9..cc7f46c0b35ff64582098a2ef74e227b18a5c36b 100644 (file)
--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c
@@ -1598,8 +1598,7 @@ static void hclge_query_reg_info_of_ssu(struct hclge_dev *hdev)
 {
        u32 loop_para[HCLGE_MOD_MSG_PARA_ARRAY_MAX_SIZE] = {0};
        struct hclge_mod_reg_common_msg msg;
-       u8 i, j, num;
-       u32 loop_time;
+       u8 i, j, num, loop_time;
 
        num = ARRAY_SIZE(hclge_ssu_reg_common_msg);
        for (i = 0; i < num; i++) {
@@ -1609,7 +1608,8 @@ static void hclge_query_reg_info_of_ssu(struct hclge_dev *hdev)
                loop_time = 1;
                loop_para[0] = 0;
                if (msg.need_para) {
-                       loop_time = hdev->ae_dev->dev_specs.tnl_num;
+                       loop_time = min(hdev->ae_dev->dev_specs.tnl_num,
+                                       HCLGE_MOD_MSG_PARA_ARRAY_MAX_SIZE);
                        for (j = 0; j < loop_time; j++)
                                loop_para[j] = j + 1;
                }