From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 1DEAFA04AB; Mon, 11 Nov 2019 15:33:04 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id E4FAD2A66; Mon, 11 Nov 2019 15:33:03 +0100 (CET) Received: from mellanox.co.il (mail-il-dmz.mellanox.com [193.47.165.129]) by dpdk.org (Postfix) with ESMTP id 2882B237 for ; Mon, 11 Nov 2019 15:33:02 +0100 (CET) Received: from Internal Mail-Server by MTLPINE1 (envelope-from dekelp@mellanox.com) with ESMTPS (AES256-SHA encrypted); 11 Nov 2019 16:33:01 +0200 Received: from mtl-vdi-280.wap.labs.mlnx. (mtl-vdi-280.wap.labs.mlnx [10.128.130.87]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id xABEX1fs027570; Mon, 11 Nov 2019 16:33:01 +0200 From: Dekel Peled To: matan@mellanox.com, shahafs@mellanox.com, viacheslavo@mellanox.com Cc: orika@mellanox.com, dev@dpdk.org Date: Mon, 11 Nov 2019 16:32:46 +0200 Message-Id: <237a2d46d825dc33a75a8c5aee27ed5d99fb68d6.1573482597.git.dekelp@mellanox.com> X-Mailer: git-send-email 1.7.1 Subject: [dpdk-dev] [PATCH] net/mlx5: fix the get function of Rx queue type X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Function mlx5_rxq_get_type() uses the input queue index, without checking it, as index to the Rx queues array. If this value is too high, it will result in pointer to memory out of Rx queues array bounds. This patch adds check of the input queue index, to verify it is valid. Fixes: 09775c04aace ("net/mlx5: split hairpin flows") Cc: orika@mellanox.com Signed-off-by: Dekel Peled --- drivers/net/mlx5/mlx5_rxq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index 24d0eaa..f9b36ed 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -2113,7 +2113,7 @@ enum mlx5_rxq_type struct mlx5_priv *priv = dev->data->dev_private; struct mlx5_rxq_ctrl *rxq_ctrl = NULL; - if ((*priv->rxqs)[idx]) { + if (idx < priv->rxqs_n && (*priv->rxqs)[idx]) { rxq_ctrl = container_of((*priv->rxqs)[idx], struct mlx5_rxq_ctrl, rxq); -- 1.8.3.1