baseband/acc100: avoid out-of-bounds access

[ upstream commit fb6996e ] The actual maximum number of gather pointers should have been limited Coverity issue: 375803, 375813, 375819, 375827, 375831 Fixes: 5ad5060 ("baseband/acc100: add LDPC processing functions") Signed-off-by: Nicolas Chautru <nicolas.chautru@intel.com>
bluca · Feb 28, 2022 · dceebf9 · dceebf9
1 parent ced8638
commit dceebf9
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/drivers/baseband/acc100/rte_acc100_pmd.c b/drivers/baseband/acc100/rte_acc100_pmd.c
@@ -1458,8 +1458,7 @@ acc100_dma_fill_blk_type_in(struct acc100_dma_req_desc *desc,
 	next_triplet++;
 
 	while (cb_len > 0) {
-		if (next_triplet < ACC100_DMA_MAX_NUM_POINTERS &&
-				m->next != NULL) {
+		if (next_triplet < ACC100_DMA_MAX_NUM_POINTERS_IN && m->next != NULL) {
 
 			m = m->next;
 			*seg_total_left = rte_pktmbuf_data_len(m);

diff --git a/drivers/baseband/acc100/rte_acc100_pmd.h b/drivers/baseband/acc100/rte_acc100_pmd.h
@@ -113,6 +113,7 @@
 #define ACC100_SW_RING_MEM_ALLOC_ATTEMPTS 5
 #define ACC100_MAX_QUEUE_DEPTH            1024
 #define ACC100_DMA_MAX_NUM_POINTERS       14
+#define ACC100_DMA_MAX_NUM_POINTERS_IN    7
 #define ACC100_DMA_DESC_PADDING           8
 #define ACC100_FCW_PADDING                12
 #define ACC100_DESC_FCW_OFFSET            192