[v3,5/5] net/mvneta: fix possible out-of-bounds write
Checks
Commit Message
The mvneta_ifnames_get() function will save 'iface' value to ifnames,
it will out-of-bounds write if passed many iface pairs (e.g.
'iface=xxx,iface=xxx,...').
Fixes: 4ccc8d770d3b ("net/mvneta: add PMD skeleton")
Cc: stable@dpdk.org
Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
---
drivers/net/mvneta/mvneta_ethdev.c | 3 +++
1 file changed, 3 insertions(+)
Comments
On 11/3/2023 7:38 AM, Chengwen Feng wrote:
> The mvneta_ifnames_get() function will save 'iface' value to ifnames,
> it will out-of-bounds write if passed many iface pairs (e.g.
> 'iface=xxx,iface=xxx,...').
>
> Fixes: 4ccc8d770d3b ("net/mvneta: add PMD skeleton")
> Cc: stable@dpdk.org
>
> Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
>
Acked-by: Ferruh Yigit <ferruh.yigit@amd.com>
@@ -91,6 +91,9 @@ mvneta_ifnames_get(const char *key __rte_unused, const char *value,
{
struct mvneta_ifnames *ifnames = extra_args;
+ if (ifnames->idx >= NETA_NUM_ETH_PPIO)
+ return -EINVAL;
+
ifnames->names[ifnames->idx++] = value;
return 0;