[PATCH 2/9] net/ice/base: add bounds check

[Bruce Richardson]

From: Fabio Pricoco <fabio.pric...@intel.com>

Refactor while loop to add a check that the values read are in the
correct range.

Fixes: 6c1f26be50a2 ("net/ice/base: add control queue information")
Cc: sta...@dpdk.org

Signed-off-by: Fabio Pricoco <fabio.pric...@intel.com>
Signed-off-by: Bruce Richardson <bruce.richard...@intel.com>
---
 drivers/net/ice/base/ice_controlq.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ice/base/ice_controlq.c 
b/drivers/net/ice/base/ice_controlq.c
index af27dc8542..b210495827 100644
--- a/drivers/net/ice/base/ice_controlq.c
+++ b/drivers/net/ice/base/ice_controlq.c
@@ -839,16 +839,35 @@ static u16 ice_clean_sq(struct ice_hw *hw, struct 
ice_ctl_q_info *cq)
        struct ice_ctl_q_ring *sq = &cq->sq;
        u16 ntc = sq->next_to_clean;
        struct ice_aq_desc *desc;
+       u32 head;
 
        desc = ICE_CTL_Q_DESC(*sq, ntc);
 
-       while (rd32(hw, cq->sq.head) != ntc) {
-               ice_debug(hw, ICE_DBG_AQ_MSG, "ntc %d head %d.\n", ntc, 
rd32(hw, cq->sq.head));
+       head = rd32(hw, sq->head);
+       if (head >= sq->count) {
+               ice_debug(hw, ICE_DBG_AQ_MSG,
+                         "Read head value (%d) exceeds allowed range.\n",
+                         head);
+               return 0;
+       }
+
+       while (head != ntc) {
+               ice_debug(hw, ICE_DBG_AQ_MSG,
+                         "ntc %d head %d.\n",
+                         ntc, head);
                ice_memset(desc, 0, sizeof(*desc), ICE_DMA_MEM);
                ntc++;
                if (ntc == sq->count)
                        ntc = 0;
                desc = ICE_CTL_Q_DESC(*sq, ntc);
+
+               head = rd32(hw, sq->head);
+               if (head >= sq->count) {
+                       ice_debug(hw, ICE_DBG_AQ_MSG,
+                                 "Read head value (%d) exceeds allowed 
range.\n",
+                                 head);
+                       return 0;
+               }
        }
 
        sq->next_to_clean = ntc;
-- 
2.43.0