[PATCH net] qed: Don't write past the end of GRC debug buffer

[Jamie Bainbridge <jamie.bainbridge@gmail.com>]

In the GRC dump path, "len" count of dword-sized registers are read into
the previously-allocated GRC dump buffer.

However, the amount of data written into the GRC dump buffer is never
checked against the length of the dump buffer. This can result in
writing past the end of the dump buffer's kmalloc and a kernel panic.

Resolve this by clamping the amount of data written to the length of the
dump buffer, avoiding the out-of-bounds memory access and panic.

Fixes: d52c89f120de8 ("qed*: Utilize FW 8.37.2.0")
Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
---
 drivers/net/ethernet/qlogic/qed/qed_debug.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
index 9c3d3dd2f84753100d3c639505677bd53e3ca543..2e88fd79a02e220fc05caa8c27bb7d41b4b37c0d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
@@ -2085,6 +2085,13 @@ static u32 qed_grc_dump_addr_range(struct qed_hwfn *p_hwfn,
 		dev_data->pretend.split_id = split_id;
 	}
 
+	/* Ensure we don't write past the end of the GRC buffer */
+	u32 buf_size_bytes = p_hwfn->cdev->dbg_features[DBG_FEATURE_GRC].buf_size;
+	u32 len_bytes = len * sizeof(u32);
+
+	if (len_bytes > buf_size_bytes)
+		len = buf_size_bytes / sizeof(u32);
+
 	/* Read registers using GRC */
 	qed_read_regs(p_hwfn, p_ptt, dump_buf, addr, len);
 
-- 
2.39.5