From 6b7af102d02cc9f07420c42fb4fae6a70adfa105 Mon Sep 17 00:00:00 2001 From: Dekel Peled Date: Mon, 11 Nov 2019 16:32:46 +0200 Subject: [PATCH] net/mlx5: fix getting Rx queue type Function mlx5_rxq_get_type() uses the input queue index, without checking it, as index to the Rx queues array. If this value is too high, it will result in pointer to memory out of Rx queues array bounds. This patch adds check of the input queue index, to verify it is valid. Fixes: d85c7b5ea59f ("net/mlx5: split hairpin flows") Signed-off-by: Dekel Peled Acked-by: Matan Azrad --- drivers/net/mlx5/mlx5_rxq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index 88a42d02f4..2a12d5fa34 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -2115,7 +2115,7 @@ mlx5_rxq_get_type(struct rte_eth_dev *dev, uint16_t idx) struct mlx5_priv *priv = dev->data->dev_private; struct mlx5_rxq_ctrl *rxq_ctrl = NULL; - if ((*priv->rxqs)[idx]) { + if (idx < priv->rxqs_n && (*priv->rxqs)[idx]) { rxq_ctrl = container_of((*priv->rxqs)[idx], struct mlx5_rxq_ctrl, rxq); -- 2.20.1