If hardware or corrupt DMA data fails to set the FINAL bit in the
scatter-gather table, the while loop in eth_sg_fd_to_mbuf() walks
past the end of the SGT buffer. Add DPAA2_MAX_SGS as an upper bound.
Not tested, found by code review.
Fixes: 774e9ea91971 ("net/dpaa2: add support for multi seg buffers")
Cc: [email protected]
Reported-by: Stephen Hemminger <[email protected]>
Signed-off-by: Maxime Leroy <[email protected]>
---
drivers/net/dpaa2/dpaa2_rxtx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 8275ba9780..b316e23e87 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -335,7 +335,7 @@ eth_sg_fd_to_mbuf(const struct qbman_fd *fd,
(void **)&first_seg, 1, 1);
#endif
cur_seg = first_seg;
- while (!DPAA2_SG_IS_FINAL(sge)) {
+ while (!DPAA2_SG_IS_FINAL(sge) && i < DPAA2_MAX_SGS) {
sge = &sgt[i++];
sg_addr = (size_t)DPAA2_IOVA_TO_VADDR(
DPAA2_GET_FLE_ADDR(sge));
--
2.43.0
