From: Piotr Kwapulinski <piotr.kwapulin...@intel.com>

Add bounds check for ch[] array.
Use ARRAY_SIZE() to ensure that idx is within the range.

Signed-off-by: Piotr Kwapulinski <piotr.kwapulin...@intel.com>
Tested-by: Andrew Bowers <andrewx.bow...@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirs...@intel.com>
---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c 
b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index 2390bfff7581..c4c71cf7c4d7 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2135,8 +2135,13 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, 
u8 *msg)
                        }
                }
 
-               if (vf->adq_enabled)
+               if (vf->adq_enabled) {
+                       if (idx >= ARRAY_SIZE(vf->ch)) {
+                               aq_ret = I40E_ERR_NO_AVAILABLE_VSI;
+                               goto error_param;
+                       }
                        vsi_id = vf->ch[idx].vsi_id;
+               }
 
                if (i40e_config_vsi_rx_queue(vf, vsi_id, vsi_queue_id,
                                             &qpi->rxq) ||
@@ -2152,6 +2157,10 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, 
u8 *msg)
                 * to its appropriate VSIs based on TC mapping
                 **/
                if (vf->adq_enabled) {
+                       if (idx >= ARRAY_SIZE(vf->ch)) {
+                               aq_ret = I40E_ERR_NO_AVAILABLE_VSI;
+                               goto error_param;
+                       }
                        if (j == (vf->ch[idx].num_qps - 1)) {
                                idx++;
                                j = 0; /* resetting the queue count */
-- 
2.21.0

Reply via email to