[dpdk-dev] [PATCH v1] net/softnic: fix out of bound access

[Savinay Dharmappa]

This patch fixes out of bound access of an array.

Coverity issue: 363466, 363459
Fixes: b5dfa6703d49 ("net/softnic: update subport rate dynamically")

Signed-off-by: Savinay Dharmappa <savinay.dharma...@intel.com>
---
 drivers/net/softnic/rte_eth_softnic_tm.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/net/softnic/rte_eth_softnic_tm.c 
b/drivers/net/softnic/rte_eth_softnic_tm.c
index 725b0231ae..df09d62d70 100644
--- a/drivers/net/softnic/rte_eth_softnic_tm.c
+++ b/drivers/net/softnic/rte_eth_softnic_tm.c
@@ -1147,10 +1147,15 @@ update_subport_tc_rate(struct rte_eth_dev *dev,
        struct tm_node *ns = np->parent_node;
        uint32_t subport_id = tm_node_subport_id(dev, ns);
        struct tm_params *t = &p->soft.tm.params;
-       uint32_t subport_profile_id = t->subport_to_profile[subport_id];
+       uint32_t subport_profile_id;
        struct tm_shaper_profile *sp_old = tm_shaper_profile_search(dev,
                ss->shaper_profile_id);
 
+       if (subport_id < TM_MAX_SUBPORT_PROFILE)
+               subport_profile_id = t->subport_to_profile[subport_id];
+       else
+               return -1;
+
        /* Derive new subport configuration. */
        memcpy(&subport_profile,
                &p->soft.tm.params.subport_profile[subport_profile_id],
@@ -2370,7 +2375,10 @@ subport_profile_get(struct rte_eth_dev *dev, struct 
tm_node *np)
        struct tm_params *t = &p->soft.tm.params;
        uint32_t subport_id = tm_node_subport_id(dev, np->parent_node);
 
-       return &t->subport_profile[subport_id];
+       if (subport_id < TM_MAX_SUBPORT_PROFILE)
+               return &t->subport_profile[subport_id];
+       else
+               return NULL;
 }
 
 static void
@@ -3024,6 +3032,9 @@ update_subport_rate(struct rte_eth_dev *dev,
        struct rte_sched_subport_profile_params profile1;
        uint32_t subport_profile_id;
 
+       if (profile0 == NULL)
+               return -1;
+
        /* Derive new pipe profile. */
        memcpy(&profile1, profile0, sizeof(profile1));
        profile1.tb_rate = sp->params.peak.rate;
-- 
2.17.1