The mvneta_ifnames_get() function will save 'iface' value to ifnames,
it will out-of-bounds write if passed many iface pairs (e.g.
'iface=xxx,iface=xxx,...').

Fixes: 4ccc8d770d3b ("net/mvneta: add PMD skeleton")
Cc: sta...@dpdk.org

Signed-off-by: Chengwen Feng <fengcheng...@huawei.com>
---
 drivers/net/mvneta/mvneta_ethdev.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/mvneta/mvneta_ethdev.c 
b/drivers/net/mvneta/mvneta_ethdev.c
index daa69e533a..8032a712f4 100644
--- a/drivers/net/mvneta/mvneta_ethdev.c
+++ b/drivers/net/mvneta/mvneta_ethdev.c
@@ -91,6 +91,9 @@ mvneta_ifnames_get(const char *key __rte_unused, const char 
*value,
 {
        struct mvneta_ifnames *ifnames = extra_args;
 
+       if (ifnames->idx >= NETA_NUM_ETH_PPIO)
+               return -EINVAL;
+
        ifnames->names[ifnames->idx++] = value;
 
        return 0;
-- 
2.17.1

Reply via email to