vdpa/ifc: fix build with GCC 12

GCC 12 raises the following warning:

../drivers/vdpa/ifc/ifcvf_vdpa.c: In function ‘vdpa_enable_vfio_intr’:
../drivers/vdpa/ifc/ifcvf_vdpa.c:383:62: error: writing 4 bytes into a
    region of size 0 [-Werror=stringop-overflow=]
  383 |                         fd_ptr[RTE_INTR_VEC_RXTX_OFFSET + i] = fd;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~
../drivers/vdpa/ifc/ifcvf_vdpa.c:348:14: note: at offset 32 into
    destination object ‘irq_set_buf’ of size 32
  348 |         char irq_set_buf[MSIX_IRQ_SET_BUF_LEN];
      |              ^~~~~~~~~~~

Validate number of vrings to avoid out of bound access.

Bugzilla ID: 855
Cc: stable@dpdk.org
Signed-off-by: David Marchand <david.marchand@redhat.com>
Acked-by: Xiao Wang <xiao.w.wang@intel.com>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>

diff --git a/drivers/vdpa/ifc/ifcvf_vdpa.c b/drivers/vdpa/ifc/ifcvf_vdpa.c
index 40a18b250754057f60d78ad7e86bd2b82c664c7e..8bc971cb12434c41e6a0118c18ac59780fe6b55b 100644 (file)
--- a/drivers/vdpa/ifc/ifcvf_vdpa.c
+++ b/drivers/vdpa/ifc/ifcvf_vdpa.c
@@ -388,6 +388,8 @@ vdpa_enable_vfio_intr(struct ifcvf_internal *internal, bool m_rx)
        vring.callfd = -1;
 
        nr_vring = rte_vhost_get_vring_num(internal->vid);
+       if (nr_vring > IFCVF_MAX_QUEUES * 2)
+               return -1;
 
        irq_set = (struct vfio_irq_set *)irq_set_buf;
        irq_set->argsz = sizeof(irq_set_buf);