From: Jie Liu <[email protected]>
sxe2_switchdev_repr_private_data_init() indexes
parent_adapter->repr_ctxt.repr_vf_id[repr_id] without checking that
repr_id is within the number of configured VFs, which can access out
of bounds when an invalid representor ID is passed.
Add a bounds check on repr_id against repr_ctxt.nb_vf and return
-EINVAL on the error path.
Fixes: 635084db5d57 ("net/sxe2: support VF representors")
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Jie Liu <[email protected]>
---
drivers/net/sxe2/sxe2_switchdev.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/sxe2/sxe2_switchdev.c
b/drivers/net/sxe2/sxe2_switchdev.c
index efb1468b91..d0304ccc94 100644
--- a/drivers/net/sxe2/sxe2_switchdev.c
+++ b/drivers/net/sxe2/sxe2_switchdev.c
@@ -312,6 +312,12 @@ int32_t sxe2_switchdev_repr_private_data_init(struct
rte_eth_dev *dev,
repr_priv_data->repr_q_id = repr_id;
repr_priv_data->repr_pf_id = parent_adapter->pf_idx;
repr_priv_data->repr_vf_id = repr_id;
+ if (repr_id >= parent_adapter->repr_ctxt.nb_vf) {
+ PMD_LOG_ERR(INIT, "repr_id %u exceed max vf %u",
+ repr_id, parent_adapter->repr_ctxt.nb_vf);
+ ret = -EINVAL;
+ goto l_free;
+ }
repr_priv_data->repr_vf_primary_vsi_id =
parent_adapter->repr_ctxt.repr_vf_id[repr_id].kernel_vsi_id;
repr_priv_data->repr_vf_backup_vsi_id =
--
2.52.0
