Add some bounds checking to prevent memory corruption in
bnxt_re_cc_config_set(). This is debugfs code so the bug can only be
triggered by root.
Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook")
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
---
drivers/infiniband/hw/bnxt_re/debugfs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c
index f4dd2fb51867..d7354e7753fe 100644
--- a/drivers/infiniband/hw/bnxt_re/debugfs.c
+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c
@@ -285,6 +285,9 @@ static ssize_t bnxt_re_cc_config_set(struct file *filp, const char __user *buffe
u32 val;
int rc;
+ if (count >= sizeof(buf))
+ return -EINVAL;
+
if (copy_from_user(buf, buffer, count))
return -EFAULT;
--
2.47.2
