Applied to dpdk-next-net-mrvl/for-main. Thanks ________________________________ From: Sergei Iashin <[email protected]> Sent: Tuesday, April 7, 2026 5:00 PM To: Harman Kalra <[email protected]>; Santosh Shukla <[email protected]>; Jerin Jacob <[email protected]> Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>; Sergei Iashin <[email protected]> Subject: [EXTERNAL] [PATCH] net/octeontx/base: fix out-of-bounds read in DQ range lookup
In octeontx_pko_dq_range_lookup(), the inner while loop evaluates the array access ctl->dq_map[dq]. chanid before the bounds check dq < RTE_DIM(ctl->dq_map). When dq is incremented to 256 inside the loop, the next iteration reads one ZjQcmQRYFpfptBannerStart Prioritize security for external emails: Confirm sender and content safety before clicking links or opening attachments <https://us-phishalarm-ewt.proofpoint.com/EWT/v1/CRVmXkqW!tm3Z1f8UYnVa9O-cmb1abtPB-IORJwK3Jr3VXVds937zvL1Te5uABuIyTLhBPe1u0lFyd2PYF2MzgfBRj9IabE7Hc6ItR791qHo$> Report Suspicious ZjQcmQRYFpfptBannerEnd In octeontx_pko_dq_range_lookup(), the inner while loop evaluates the array access ctl->dq_map[dq].chanid before the bounds check dq < RTE_DIM(ctl->dq_map). When dq is incremented to 256 inside the loop, the next iteration reads one element past the end of the 256-element dq_map array before the bounds condition can short-circuit. Swap the two conjuncts so the bounds check is evaluated first, matching the pattern already used in the outer loop. Fixes: cad78ca23818 ("net/octeontx/base: add base PKO operations") Cc: [email protected] Cc: [email protected] Signed-off-by: Sergei Iashin <[email protected]> --- drivers/net/octeontx/base/octeontx_pkovf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/octeontx/base/octeontx_pkovf.c b/drivers/net/octeontx/base/octeontx_pkovf.c index 7aec84a813..5326fe24b9 100644 --- a/drivers/net/octeontx/base/octeontx_pkovf.c +++ b/drivers/net/octeontx/base/octeontx_pkovf.c @@ -196,8 +196,8 @@ octeontx_pko_dq_range_lookup(struct octeontx_pko_vf_ctl_s *ctl, uint64_t chanid, while (dq < RTE_DIM(ctl->dq_map)) { dq_base = dq; dq_cnt = 0; - while (ctl->dq_map[dq].chanid == ~chanid && - dq < RTE_DIM(ctl->dq_map)) { + while (dq < RTE_DIM(ctl->dq_map) && + ctl->dq_map[dq].chanid == ~chanid) { dq_cnt++; if (dq_cnt == dq_num) return dq_base; -- 2.39.5
