If hardware returned a bogus number of vnic's from the query it could cause an out of bounds read into vnic table.
Reported-by: Christopher Ertl <christopher.e...@microsoft.com> Signed-off-by: Stephen Hemminger <step...@networkplumber.org> --- drivers/net/bnxt/bnxt_hwrm.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index 20e2f6a36713..ad8bdb1c2913 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -4029,6 +4029,12 @@ static int bnxt_hwrm_func_vf_vnic_query(struct bnxt *bp, uint16_t vf, HWRM_UNLOCK(); + if (rc > bp->pf.total_vnics) { + PMD_DRV_LOG(ERR, + "Vnic id %d is out of range\n", rc); + return -EINVAL; + } + return rc; } -- 2.20.1