nix_fc_rq_config_set() indexes nix->rqs[] with the caller-supplied
fc_cfg->rq_cfg.rq without any bound or NULL check, unlike
roc_nix_rq_init(). An out-of-range rq reads a pointer past the
nb_rx_queues-sized array and then dereferences and writes through it
(rq->tc), and an in-range but uninitialised rq is a NULL deref.
Reject rq >= nb_rx_queues with NIX_ERR_QUEUE_INVALID_RANGE and a NULL
rq with NIX_ERR_PARAM before use, matching the sibling ROC helpers.
Fixes: 78fb5efed869 ("common/cnxk: remove flow control config at queue setup")
Cc: [email protected]
Signed-off-by: Aarnav JP <[email protected]>
---
drivers/common/cnxk/roc_nix_fc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/common/cnxk/roc_nix_fc.c b/drivers/common/cnxk/roc_nix_fc.c
index abf923b722..8164a2ba0e 100644
--- a/drivers/common/cnxk/roc_nix_fc.c
+++ b/drivers/common/cnxk/roc_nix_fc.c
@@ -358,7 +358,12 @@ nix_fc_rq_config_set(struct roc_nix *roc_nix, struct
roc_nix_fc_cfg *fc_cfg)
struct roc_nix_rq *rq;
int rc;
+ if (fc_cfg->rq_cfg.rq >= nix->nb_rx_queues)
+ return NIX_ERR_QUEUE_INVALID_RANGE;
+
rq = nix->rqs[fc_cfg->rq_cfg.rq];
+ if (rq == NULL)
+ return NIX_ERR_PARAM;
if (rq->sso_ena) {
pool_drop_pct = fc_cfg->rq_cfg.pool_drop_pct;
--
2.43.0
