From 45758e42183af0849843d43f55ab20978a1e8944 Mon Sep 17 00:00:00 2001 From: Savinay Dharmappa Date: Mon, 19 Oct 2020 12:52:16 +0100 Subject: [PATCH] net/softnic: fix out-of-bound access This patch fixes out of bound access of an array. Coverity issue: 363466, 363459 Fixes: b5dfa6703d49 ("net/softnic: update subport rate dynamically") Cc: stable@dpdk.org Signed-off-by: Savinay Dharmappa Acked-by: Cristian Dumitrescu --- drivers/net/softnic/rte_eth_softnic_tm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/softnic/rte_eth_softnic_tm.c b/drivers/net/softnic/rte_eth_softnic_tm.c index 725b0231ae..90baba15ce 100644 --- a/drivers/net/softnic/rte_eth_softnic_tm.c +++ b/drivers/net/softnic/rte_eth_softnic_tm.c @@ -1147,10 +1147,15 @@ update_subport_tc_rate(struct rte_eth_dev *dev, struct tm_node *ns = np->parent_node; uint32_t subport_id = tm_node_subport_id(dev, ns); struct tm_params *t = &p->soft.tm.params; - uint32_t subport_profile_id = t->subport_to_profile[subport_id]; + uint32_t subport_profile_id; struct tm_shaper_profile *sp_old = tm_shaper_profile_search(dev, ss->shaper_profile_id); + if (subport_id >= TM_MAX_SUBPORT_PROFILE) + return -1; + + subport_profile_id = t->subport_to_profile[subport_id]; + /* Derive new subport configuration. */ memcpy(&subport_profile, &p->soft.tm.params.subport_profile[subport_profile_id], @@ -2370,6 +2375,9 @@ subport_profile_get(struct rte_eth_dev *dev, struct tm_node *np) struct tm_params *t = &p->soft.tm.params; uint32_t subport_id = tm_node_subport_id(dev, np->parent_node); + if (subport_id >= TM_MAX_SUBPORT_PROFILE) + return NULL; + return &t->subport_profile[subport_id]; } @@ -3024,6 +3032,9 @@ update_subport_rate(struct rte_eth_dev *dev, struct rte_sched_subport_profile_params profile1; uint32_t subport_profile_id; + if (profile0 == NULL) + return -1; + /* Derive new pipe profile. */ memcpy(&profile1, profile0, sizeof(profile1)); profile1.tb_rate = sp->params.peak.rate; -- 2.20.1