baseband/acc100: avoid out-of-bounds access

The actual maximum number of gather pointers should have been limited

Coverity issue: 375803, 375813, 375819, 375827, 375831
Fixes: 5ad5060f8f7a ("baseband/acc100: add LDPC processing functions")
Cc: stable@dpdk.org
Signed-off-by: Nicolas Chautru <nicolas.chautru@intel.com>

diff --git a/drivers/baseband/acc100/rte_acc100_pmd.c b/drivers/baseband/acc100/rte_acc100_pmd.c
index f86474f..de7e4bc 100644 (file)
--- a/drivers/baseband/acc100/rte_acc100_pmd.c
+++ b/drivers/baseband/acc100/rte_acc100_pmd.c
@@ -1460,8 +1460,7 @@ acc100_dma_fill_blk_type_in(struct acc100_dma_req_desc *desc,
        next_triplet++;
 
        while (cb_len > 0) {
-               if (next_triplet < ACC100_DMA_MAX_NUM_POINTERS &&
-                               m->next != NULL) {
+               if (next_triplet < ACC100_DMA_MAX_NUM_POINTERS_IN && m->next != NULL) {
 
                        m = m->next;
                        *seg_total_left = rte_pktmbuf_data_len(m);

diff --git a/drivers/baseband/acc100/rte_acc100_pmd.h b/drivers/baseband/acc100/rte_acc100_pmd.h
index 03ed0b3..cbcece2 100644 (file)
--- a/drivers/baseband/acc100/rte_acc100_pmd.h
+++ b/drivers/baseband/acc100/rte_acc100_pmd.h
@@ -113,6 +113,7 @@
 #define ACC100_SW_RING_MEM_ALLOC_ATTEMPTS 5
 #define ACC100_MAX_QUEUE_DEPTH            1024
 #define ACC100_DMA_MAX_NUM_POINTERS       14
+#define ACC100_DMA_MAX_NUM_POINTERS_IN    7
 #define ACC100_DMA_DESC_PADDING           8
 #define ACC100_FCW_PADDING                12
 #define ACC100_DESC_FCW_OFFSET            192