rte_pmd_ntb_get_mem_align() only checked the device index range and
the presence of private data before casting it to struct ntb_hw.
Passing the id of a detached slot or of a rawdev from another driver
would then call through a garbage ops pointer.
Check that the device is attached and is driven by this PMD.
Also return 0 for an out of range memory window index, as documented,
instead of a cache line size.
Fixes: 5ce50c234ad1 ("raw/ntb: generalize framework for multiple vendors")
Signed-off-by: Raghavendra Ningoji <[email protected]>
---
drivers/raw/ntb/ntb.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/raw/ntb/ntb.c b/drivers/raw/ntb/ntb.c
index fe10782ecf..e42af0b9c5 100644
--- a/drivers/raw/ntb/ntb.c
+++ b/drivers/raw/ntb/ntb.c
@@ -33,6 +33,8 @@ static const struct rte_pci_id pci_id_ntb_map[] = {
{ .vendor_id = 0, /* sentinel */ },
};
+static const struct rte_rawdev_ops ntb_ops;
+
/* Align with enum ntb_xstats_idx */
static struct rte_rawdev_xstats_name ntb_xstats_names[] = {
{"Tx-packets"},
@@ -722,15 +724,15 @@ rte_pmd_ntb_get_mem_align(uint16_t dev_id, uint32_t
mw_id, uint64_t mw_len)
struct rte_rawdev *dev;
struct ntb_hw *hw;
- if (dev_id >= RTE_RAWDEV_MAX_DEVS)
+ if (dev_id >= RTE_RAWDEV_MAX_DEVS ||
!rte_rawdev_pmd_is_valid_dev(dev_id))
return 0;
dev = rte_rawdev_pmd_get_dev(dev_id);
- if (dev->dev_private == NULL)
+ if (dev->dev_ops != &ntb_ops)
return 0;
hw = dev->dev_private;
if (mw_id >= hw->mw_cnt)
- return RTE_CACHE_LINE_SIZE;
+ return 0;
return (*hw->ntb_ops->mem_align)(dev, mw_id, mw_len);
}
--
2.34.1
