[PATCH] net: prestera: validate num_counters in counter response

prestera_hw_counters_get() iterates over resp->num_counters
entries from the firmware response without verifying it does
not exceed the number of entries requested. A firmware response
claiming more counters than requested causes out-of-bounds reads
from the response buffer and out-of-bounds writes to the caller
stats array.

Validate that num_counters does not exceed the requested count
before iterating.

Fixes: 6e36c7bcb461 ("net: prestera: add counter HW API")
Signed-off-by: Aamir Ahmed <redacted>
---
 drivers/net/ethernet/marvell/prestera/prestera_hw.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/marvell/prestera/prestera_hw.c b/drivers/net/ethernet/marvell/prestera/prestera_hw.c
index 7695cbb2ce62..c4cb5f22893c 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_hw.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_hw.c

@@ -2324,6 +2324,11 @@ int prestera_hw_counters_get(struct prestera_switch *sw, u32 idx,
 	if (err)
 		goto free_buff;
 
+	if (__le32_to_cpu(resp->num_counters) > *len) {
+		err = -EINVAL;
+		goto free_buff;
+	}
+
 	for (i = 0; i < __le32_to_cpu(resp->num_counters); i++) {
 		stats[i].packets += __le64_to_cpu(resp->stats[i].packets);
 		stats[i].bytes += __le64_to_cpu(resp->stats[i].bytes);

-- 
2.43.0