From: Rupesh Chiluka <[email protected]> prepare_iov_from_pkt() and prepare_iov_from_pkt_inplace() rely on nb_segs to limit the number of segments written to the on-stack iovec. Also check the index against ROC_MAX_SG_CNT inside the walk, so a chain longer than nb_segs reports cannot overrun the buffer.
Signed-off-by: Rupesh Chiluka <[email protected]> --- drivers/crypto/cnxk/cnxk_se.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/crypto/cnxk/cnxk_se.h b/drivers/crypto/cnxk/cnxk_se.h index a3c3c3ce86..b93a2bfaf8 100644 --- a/drivers/crypto/cnxk/cnxk_se.h +++ b/drivers/crypto/cnxk/cnxk_se.h @@ -2720,6 +2720,11 @@ prepare_iov_from_pkt(struct rte_mbuf *pkt, struct roc_se_iov_ptr *iovec, uint32_ if (!seg_size) break; + if (unlikely(index >= ROC_MAX_SG_CNT)) { + plt_dp_err("Number of segments exceeds max supported (%u)", ROC_MAX_SG_CNT); + return 1; + } + iovec->bufs[index].vaddr = seg_data; iovec->bufs[index].size = seg_size; @@ -2776,6 +2781,11 @@ prepare_iov_from_pkt_inplace(struct rte_mbuf *pkt, if (!seg_size) break; + if (unlikely(index >= ROC_MAX_SG_CNT)) { + plt_dp_err("Number of segments exceeds max supported (%u)", ROC_MAX_SG_CNT); + return 1; + } + iovec->bufs[index].vaddr = seg_data; iovec->bufs[index].size = seg_size; -- 2.43.0
