The mvneta_ifnames_get() function will save 'iface' value to ifnames,
it will out-of-bounds write if passed many iface pairs (e.g.
'iface=xxx,iface=xxx,...').
Fixes: 4ccc8d770d3b ("net/mvneta: add PMD skeleton")
Cc: [email protected]
Signed-off-by: Chengwen Feng <[email protected]>
Acked-by: Ferruh Yigit <[email protected]>
---
v2: add error log which address Stephen's comment.
---
drivers/net/mvneta/mvneta_ethdev.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/mvneta/mvneta_ethdev.c
b/drivers/net/mvneta/mvneta_ethdev.c
index 3841c1ebe9..e641f19266 100644
--- a/drivers/net/mvneta/mvneta_ethdev.c
+++ b/drivers/net/mvneta/mvneta_ethdev.c
@@ -91,6 +91,11 @@ mvneta_ifnames_get(const char *key __rte_unused, const char
*value,
{
struct mvneta_ifnames *ifnames = extra_args;
+ if (ifnames->idx >= NETA_NUM_ETH_PPIO) {
+ MVNETA_LOG(ERROR, "Detect too many ifnames!");
+ return -EINVAL;
+ }
+
ifnames->names[ifnames->idx++] = value;
return 0;
--
2.17.1