If a request to read a small value is passed to nvram reader it would underflow.
Reported-by: Christopher Ertl <christopher.e...@microsoft.com> Signed-off-by: Stephen Hemminger <step...@networkplumber.org> --- drivers/net/bnxt/bnxt_hwrm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index 6beb215d604f..d878320aa110 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -3859,6 +3859,9 @@ int bnxt_get_nvram_directory(struct bnxt *bp, uint32_t len, uint8_t *data) *data++ = dir_entries; *data++ = entry_length; + if (len <= 2) + return -EINVAL; + len -= 2; memset(data, 0xff, len); -- 2.20.1