[PATCH RFC]Fix rocker device null-pointer crash.

[sohu0106]

From 503b08d3b8d8faa93c3f5d2bc9eb8b52a7772b85 Mon Sep 17 00:00:00 2001
From: sohu0106 <sohu0...@126.com>
Date: Wed, 21 Jul 2021 10:07:07 +0800
Subject: [RFC] Fix rocker device null pointer crash. qemu config r->fp_ports
 with "-device rocker,len-ports=10" when guest config port larget then
 r->fp_ports(10) r->fp_port[port] is null-pointer,qemu will crash null-pointer
 Reported-by: chenzhe <chen...@huawei.com>

Signed-off-by: sohu0106 <sohu0...@126.com>
---
 hw/net/rocker/rocker.c    | 10 +++++-----
 hw/net/rocker/rocker_fp.c |  5 +++--
 hw/net/rocker/rocker_fp.h |  2 +-
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/hw/net/rocker/rocker.c b/hw/net/rocker/rocker.c
index 31f2340fb9..431af3982f 100644
--- a/hw/net/rocker/rocker.c
+++ b/hw/net/rocker/rocker.c
@@ -174,7 +174,7 @@ static int tx_consume(Rocker *r, DescInfo *info)
     }
 
     pport = rocker_get_pport_by_tx_ring(r, desc_get_ring(info));
-    if (!fp_port_from_pport(pport, &port)) {
+    if (!fp_port_from_pport(r, pport, &port)) {
         return -ROCKER_EINVAL;
     }
 
@@ -287,7 +287,7 @@ static int cmd_get_port_settings(Rocker *r,
     }
 
     pport = rocker_tlv_get_le32(tlvs[ROCKER_TLV_CMD_PORT_SETTINGS_PPORT]);
-    if (!fp_port_from_pport(pport, &port)) {
+    if (!fp_port_from_pport(r, pport, &port)) {
         return -ROCKER_EINVAL;
     }
     fp_port = r->fp_port[port];
@@ -357,7 +357,7 @@ static int cmd_set_port_settings(Rocker *r,
     }
 
     pport = rocker_tlv_get_le32(tlvs[ROCKER_TLV_CMD_PORT_SETTINGS_PPORT]);
-    if (!fp_port_from_pport(pport, &port)) {
+    if (!fp_port_from_pport(r, pport, &port)) {
         return -ROCKER_EINVAL;
     }
     fp_port = r->fp_port[port];
@@ -538,7 +538,7 @@ int rocker_event_mac_vlan_seen(Rocker *r, uint32_t pport, 
uint8_t *addr,
     int pos;
     int err;
 
-    if (!fp_port_from_pport(pport, &port)) {
+    if (!fp_port_from_pport(r, pport, &port)) {
         return -ROCKER_EINVAL;
     }
     fp_port = r->fp_port[port];
@@ -690,7 +690,7 @@ int rocker_port_eg(Rocker *r, uint32_t pport,
     FpPort *fp_port;
     uint32_t port;
 
-    if (!fp_port_from_pport(pport, &port)) {
+    if (!fp_port_from_pport(r, pport, &port)) {
         return -ROCKER_EINVAL;
     }
 
diff --git a/hw/net/rocker/rocker_fp.c b/hw/net/rocker/rocker_fp.c
index cbeed65bd5..45b5020106 100644
--- a/hw/net/rocker/rocker_fp.c
+++ b/hw/net/rocker/rocker_fp.c
@@ -108,9 +108,10 @@ int fp_port_set_settings(FpPort *port, uint32_t speed,
     return ROCKER_OK;
 }
 
-bool fp_port_from_pport(uint32_t pport, uint32_t *port)
+bool fp_port_from_pport(Rocker *r, uint32_t pport, uint32_t *port)
 {
-    if (pport < 1 || pport > ROCKER_FP_PORTS_MAX) {
+    if (pport < 1 || pport > ROCKER_FP_PORTS_MAX ||
+        pport >= rocker_fp_ports(r)) {
         return false;
     }
     *port = pport - 1;
diff --git a/hw/net/rocker/rocker_fp.h b/hw/net/rocker/rocker_fp.h
index 7ff57aac01..bd1c2588f6 100644
--- a/hw/net/rocker/rocker_fp.h
+++ b/hw/net/rocker/rocker_fp.h
@@ -37,7 +37,7 @@ int fp_port_get_settings(FpPort *port, uint32_t *speed,
                          uint8_t *duplex, uint8_t *autoneg);
 int fp_port_set_settings(FpPort *port, uint32_t speed,
                          uint8_t duplex, uint8_t autoneg);
-bool fp_port_from_pport(uint32_t pport, uint32_t *port);
+bool fp_port_from_pport(Rocker *r, uint32_t pport, uint32_t *port);
 World *fp_port_get_world(FpPort *port);
 void fp_port_set_world(FpPort *port, World *world);
 bool fp_port_check_world(FpPort *port, World *world);
-- 
2.25.1