If a request to read a small value is passed to nvram reader
it would underflow.

Reported-by: Christopher Ertl <christopher.e...@microsoft.com>
Signed-off-by: Stephen Hemminger <step...@networkplumber.org>
---
 drivers/net/bnxt/bnxt_hwrm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c
index 6beb215d604f..d878320aa110 100644
--- a/drivers/net/bnxt/bnxt_hwrm.c
+++ b/drivers/net/bnxt/bnxt_hwrm.c
@@ -3859,6 +3859,9 @@ int bnxt_get_nvram_directory(struct bnxt *bp, uint32_t 
len, uint8_t *data)
 
        *data++ = dir_entries;
        *data++ = entry_length;
+       if (len <= 2)
+               return -EINVAL;
+
        len -= 2;
        memset(data, 0xff, len);
 
-- 
2.20.1

Reply via email to