From 0c41b6164a61495b57976c5b26f240785e7eebc4 Mon Sep 17 00:00:00 2001 From: Leyi Rong Date: Tue, 8 Mar 2022 13:56:17 +0800 Subject: [PATCH] net/iavf: fix potential out-of-bounds access [ upstream commit d78d21b983f215d1425422f955cbd934e48360d3 ] Fix potential out-of-bounds access as overrunning callee's array of size 26 by passing argument rxq->rxdid(which evaluates to 63) in call to iavf_rx_scan_hw_ring_flex_rxd. Coverity issue: 376616 Fixes: 0ed16e01313e ("net/iavf: fix function pointer in multi-process") Signed-off-by: Leyi Rong Reviewed-by: Ferruh Yigit --- drivers/net/iavf/iavf_rxtx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/iavf/iavf_rxtx.c b/drivers/net/iavf/iavf_rxtx.c index 6243199f2a..c8fa912b99 100644 --- a/drivers/net/iavf/iavf_rxtx.c +++ b/drivers/net/iavf/iavf_rxtx.c @@ -440,7 +440,7 @@ iavf_rxd_to_pkt_fields_by_comms_aux_v2(struct iavf_rx_queue *rxq, } static const -iavf_rxd_to_pkt_fields_t rxd_to_pkt_fields_ops[] = { +iavf_rxd_to_pkt_fields_t rxd_to_pkt_fields_ops[IAVF_RXDID_LAST + 1] = { [IAVF_RXDID_COMMS_AUX_VLAN] = iavf_rxd_to_pkt_fields_by_comms_aux_v1, [IAVF_RXDID_COMMS_AUX_IPV4] = iavf_rxd_to_pkt_fields_by_comms_aux_v1, [IAVF_RXDID_COMMS_AUX_IPV6] = iavf_rxd_to_pkt_fields_by_comms_aux_v1,