From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7793DA00BE for ; Tue, 8 Mar 2022 06:56:28 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 67CEB40DDB; Tue, 8 Mar 2022 06:56:28 +0100 (CET) Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mails.dpdk.org (Postfix) with ESMTP id 8C6B440041; Tue, 8 Mar 2022 06:56:25 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1646718985; x=1678254985; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=AsDXDFfhMEHIr7QBA+CXv3P1kV2gvsQurJ4hwZchRqI=; b=Krsy+Cjq2qW3uasdaWxPUu0GXv+W9AhTg8BbrQkM5te44f/ayZGm+6Gg JdtxjvvLEjZ97LiOCSNPSwb6W4/2mxcAY+7j6oCmHwUI9OfEkGr3b5io3 YH6Q7wwwS4YHapR7N8D/cwXFQkWxcTwRV2edQhS4XGdFBNf0W9OkaTrW2 g1hvl/1hTBLWh7YoXQqpWWGPbylDDw+pHmPAYkArBw61PEzataweDkLGd y7jcCLNPKTYVyal9myfDALl8HwSEzE+Q00uOfLWkAt+WD3dWx2iUlPVac 7lPiGhnQkwzlqA005TlkJmMuWY1U4ZKuXQhFOf0PDyTibTie3kFQqe+wM A==; X-IronPort-AV: E=McAfee;i="6200,9189,10279"; a="235208759" X-IronPort-AV: E=Sophos;i="5.90,163,1643702400"; d="scan'208";a="235208759" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 Mar 2022 21:56:24 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.90,163,1643702400"; d="scan'208";a="512983566" Received: from dpdk-lrong-icx-01.sh.intel.com ([10.67.119.18]) by orsmga006.jf.intel.com with ESMTP; 07 Mar 2022 21:56:22 -0800 From: Leyi Rong To: stevex.yang@intel.com, qi.z.zhang@intel.com Cc: dev@dpdk.org, Leyi Rong , stable@dpdk.org Subject: [PATCH] net/iavf: fix potential out of bounds access Date: Tue, 8 Mar 2022 13:56:17 +0800 Message-Id: <20220308055617.1465853-1-leyi.rong@intel.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Fix potential out-out-bounds access as overrunning callee's array of size 26 by passing argument rxq->rxdid(which evaluates to 63) in call to iavf_rx_scan_hw_ring_flex_rxd. Coverity issue: 376616 Fixes: 7b1ba38904a0 ("net/iavf: fix function pointer in multi-process") Cc: stable@dpdk.org Signed-off-by: Leyi Rong --- drivers/net/iavf/iavf_rxtx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/iavf/iavf_rxtx.c b/drivers/net/iavf/iavf_rxtx.c index cb779879cb..16e8d021f9 100644 --- a/drivers/net/iavf/iavf_rxtx.c +++ b/drivers/net/iavf/iavf_rxtx.c @@ -476,7 +476,7 @@ iavf_rxd_to_pkt_fields_by_comms_aux_v2(struct iavf_rx_queue *rxq, } static const -iavf_rxd_to_pkt_fields_t rxd_to_pkt_fields_ops[] = { +iavf_rxd_to_pkt_fields_t rxd_to_pkt_fields_ops[IAVF_RXDID_LAST + 1] = { [IAVF_RXDID_COMMS_AUX_VLAN] = iavf_rxd_to_pkt_fields_by_comms_aux_v1, [IAVF_RXDID_COMMS_AUX_IPV4] = iavf_rxd_to_pkt_fields_by_comms_aux_v1, [IAVF_RXDID_COMMS_AUX_IPV6] = iavf_rxd_to_pkt_fields_by_comms_aux_v1, -- 2.25.1