net/bnxt: check VF representor pointer before access

The PF or trusted VF Rx handler could invoke the VF representor's
Rx function without knowledge of the application cleaning up the
representor ports. Check if the vfr_bp pointer is valid before
accessing it.

Fixes: 6dc83230b43b ("net/bnxt: support port representor data path")
Cc: stable@dpdk.org
Signed-off-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>

diff --git a/drivers/net/bnxt/bnxt_reps.c b/drivers/net/bnxt/bnxt_reps.c
index f24f5ef75fe81f132d4325ddfb53fe648a654da9..5e140f0cdb57015f2e927884470cd64135feaede 100644 (file)
--- a/drivers/net/bnxt/bnxt_reps.c
+++ b/drivers/net/bnxt/bnxt_reps.c
@@ -35,16 +35,20 @@ static const struct eth_dev_ops bnxt_rep_dev_ops = {
 uint16_t
 bnxt_vfr_recv(uint16_t port_id, uint16_t queue_id, struct rte_mbuf *mbuf)
 {
-       struct rte_mbuf **prod_rx_buf;
+       struct bnxt_representor *vfr_bp = NULL;
        struct bnxt_rx_ring_info *rep_rxr;
-       struct bnxt_rx_queue *rep_rxq;
        struct rte_eth_dev *vfr_eth_dev;
-       struct bnxt_representor *vfr_bp;
+       struct rte_mbuf **prod_rx_buf;
+       struct bnxt_rx_queue *rep_rxq;
        uint16_t mask;
        uint8_t que;
 
        vfr_eth_dev = &rte_eth_devices[port_id];
-       vfr_bp = vfr_eth_dev->data->dev_private;
+       vfr_bp = vfr_eth_dev ? vfr_eth_dev->data->dev_private : NULL;
+
+       if (unlikely(vfr_bp == NULL))
+               return 1;
+
        /* If rxq_id happens to be > nr_rings, use ring 0 */
        que = queue_id < vfr_bp->rx_nr_rings ? queue_id : 0;
        rep_rxq = vfr_bp->rx_queues[que];