summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDekel Peled <dekelp@mellanox.com>2019-11-11 16:32:46 +0200
committerFerruh Yigit <ferruh.yigit@intel.com>2019-11-20 17:36:05 +0100
commit6b7af102d02cc9f07420c42fb4fae6a70adfa105 (patch)
treedf49bccb4afa48dcba81a9401314312c58f4bca6
parentcec19a342f45ba5a9c8be9c4dc2a0faa89981b41 (diff)
downloaddpdk-next-eventdev-6b7af102d02cc9f07420c42fb4fae6a70adfa105.zip
dpdk-next-eventdev-6b7af102d02cc9f07420c42fb4fae6a70adfa105.tar.gz
dpdk-next-eventdev-6b7af102d02cc9f07420c42fb4fae6a70adfa105.tar.xz
net/mlx5: fix getting Rx queue type
Function mlx5_rxq_get_type() uses the input queue index, without checking it, as index to the Rx queues array. If this value is too high, it will result in pointer to memory out of Rx queues array bounds. This patch adds check of the input queue index, to verify it is valid. Fixes: d85c7b5ea59f ("net/mlx5: split hairpin flows") Signed-off-by: Dekel Peled <dekelp@mellanox.com> Acked-by: Matan Azrad <matan@mellanox.com>
-rw-r--r--drivers/net/mlx5/mlx5_rxq.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index 88a42d0..2a12d5f 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2115,7 +2115,7 @@ mlx5_rxq_get_type(struct rte_eth_dev *dev, uint16_t idx)
struct mlx5_priv *priv = dev->data->dev_private;
struct mlx5_rxq_ctrl *rxq_ctrl = NULL;
- if ((*priv->rxqs)[idx]) {
+ if (idx < priv->rxqs_n && (*priv->rxqs)[idx]) {
rxq_ctrl = container_of((*priv->rxqs)[idx],
struct mlx5_rxq_ctrl,
rxq);