net/mlx5: fix getting Rx queue type

Function mlx5_rxq_get_type() uses the input queue index, without
checking it, as index to the Rx queues array.
If this value is too high, it will result in pointer to memory out
of Rx queues array bounds.

This patch adds check of the input queue index, to verify it is valid.

Fixes: d85c7b5ea59f ("net/mlx5: split hairpin flows")

Signed-off-by: Dekel Peled <dekelp@mellanox.com>
Acked-by: Matan Azrad <matan@mellanox.com>

diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index 88a42d0..2a12d5f 100644 (file)
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2115,7 +2115,7 @@ mlx5_rxq_get_type(struct rte_eth_dev *dev, uint16_t idx)
        struct mlx5_priv *priv = dev->data->dev_private;
        struct mlx5_rxq_ctrl *rxq_ctrl = NULL;
 
-       if ((*priv->rxqs)[idx]) {
+       if (idx < priv->rxqs_n && (*priv->rxqs)[idx]) {
                rxq_ctrl = container_of((*priv->rxqs)[idx],
                                        struct mlx5_rxq_ctrl,
                                        rxq);