From: Jie Liu <[email protected]> sxe2_switchdev_repr_private_data_init() indexes parent_adapter->repr_ctxt.repr_vf_id[repr_id] without checking that repr_id is within the number of configured VFs, which can access out of bounds when an invalid representor ID is passed.
Add a bounds check on repr_id against repr_ctxt.nb_vf and return -EINVAL on the error path. Cc: [email protected] Cc: [email protected] Signed-off-by: Jie Liu <[email protected]> --- drivers/net/sxe2/sxe2_switchdev.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/sxe2/sxe2_switchdev.c b/drivers/net/sxe2/sxe2_switchdev.c index efb1468b91..d0304ccc94 100644 --- a/drivers/net/sxe2/sxe2_switchdev.c +++ b/drivers/net/sxe2/sxe2_switchdev.c @@ -312,6 +312,12 @@ int32_t sxe2_switchdev_repr_private_data_init(struct rte_eth_dev *dev, repr_priv_data->repr_q_id = repr_id; repr_priv_data->repr_pf_id = parent_adapter->pf_idx; repr_priv_data->repr_vf_id = repr_id; + if (repr_id >= parent_adapter->repr_ctxt.nb_vf) { + PMD_LOG_ERR(INIT, "repr_id %u exceed max vf %u", + repr_id, parent_adapter->repr_ctxt.nb_vf); + ret = -EINVAL; + goto l_free; + } repr_priv_data->repr_vf_primary_vsi_id = parent_adapter->repr_ctxt.repr_vf_id[repr_id].kernel_vsi_id; repr_priv_data->repr_vf_backup_vsi_id = -- 2.52.0
