From fb6996eec066dc7fa0eda951e492a65c8380d930 Mon Sep 17 00:00:00 2001 From: Nicolas Chautru Date: Tue, 22 Feb 2022 15:43:36 -0800 Subject: [PATCH] baseband/acc100: avoid out-of-bounds access The actual maximum number of gather pointers should have been limited Coverity issue: 375803, 375813, 375819, 375827, 375831 Fixes: 5ad5060f8f7a ("baseband/acc100: add LDPC processing functions") Cc: stable@dpdk.org Signed-off-by: Nicolas Chautru --- drivers/baseband/acc100/rte_acc100_pmd.c | 3 +-- drivers/baseband/acc100/rte_acc100_pmd.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/baseband/acc100/rte_acc100_pmd.c b/drivers/baseband/acc100/rte_acc100_pmd.c index f86474f7e0..de7e4bcef4 100644 --- a/drivers/baseband/acc100/rte_acc100_pmd.c +++ b/drivers/baseband/acc100/rte_acc100_pmd.c @@ -1460,8 +1460,7 @@ acc100_dma_fill_blk_type_in(struct acc100_dma_req_desc *desc, next_triplet++; while (cb_len > 0) { - if (next_triplet < ACC100_DMA_MAX_NUM_POINTERS && - m->next != NULL) { + if (next_triplet < ACC100_DMA_MAX_NUM_POINTERS_IN && m->next != NULL) { m = m->next; *seg_total_left = rte_pktmbuf_data_len(m); diff --git a/drivers/baseband/acc100/rte_acc100_pmd.h b/drivers/baseband/acc100/rte_acc100_pmd.h index 03ed0b3e1a..cbcece2966 100644 --- a/drivers/baseband/acc100/rte_acc100_pmd.h +++ b/drivers/baseband/acc100/rte_acc100_pmd.h @@ -113,6 +113,7 @@ #define ACC100_SW_RING_MEM_ALLOC_ATTEMPTS 5 #define ACC100_MAX_QUEUE_DEPTH 1024 #define ACC100_DMA_MAX_NUM_POINTERS 14 +#define ACC100_DMA_MAX_NUM_POINTERS_IN 7 #define ACC100_DMA_DESC_PADDING 8 #define ACC100_FCW_PADDING 12 #define ACC100_DESC_FCW_OFFSET 192 -- 2.20.1