From e93a5f44791de38dd652eeb8d5d6984188dcb3b7 Mon Sep 17 00:00:00 2001 From: Ajit Khaparde Date: Tue, 4 Jan 2022 14:08:24 +0530 Subject: [PATCH] net/bnxt: check VF representor pointer before access [ upstream commit f30622542ccfe5e9ba31f67972e999c99e73385b ] The PF or trusted VF Rx handler could invoke the VF representor's Rx function without knowledge of the application cleaning up the representor ports. Check if the vfr_bp pointer is valid before accessing it. Fixes: 6dc83230b43b ("net/bnxt: support port representor data path") Signed-off-by: Ajit Khaparde Reviewed-by: Kalesh AP Reviewed-by: Somnath Kotur --- drivers/net/bnxt/bnxt_reps.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/net/bnxt/bnxt_reps.c b/drivers/net/bnxt/bnxt_reps.c index b9b0f62c9c..db780c3d2c 100644 --- a/drivers/net/bnxt/bnxt_reps.c +++ b/drivers/net/bnxt/bnxt_reps.c @@ -35,16 +35,20 @@ static const struct eth_dev_ops bnxt_rep_dev_ops = { uint16_t bnxt_vfr_recv(uint16_t port_id, uint16_t queue_id, struct rte_mbuf *mbuf) { - struct rte_mbuf **prod_rx_buf; + struct bnxt_representor *vfr_bp = NULL; struct bnxt_rx_ring_info *rep_rxr; - struct bnxt_rx_queue *rep_rxq; struct rte_eth_dev *vfr_eth_dev; - struct bnxt_representor *vfr_bp; + struct rte_mbuf **prod_rx_buf; + struct bnxt_rx_queue *rep_rxq; uint16_t mask; uint8_t que; vfr_eth_dev = &rte_eth_devices[port_id]; - vfr_bp = vfr_eth_dev->data->dev_private; + vfr_bp = vfr_eth_dev ? vfr_eth_dev->data->dev_private : NULL; + + if (unlikely(vfr_bp == NULL)) + return 1; + /* If rxq_id happens to be > nr_rings, use ring 0 */ que = queue_id < vfr_bp->rx_nr_rings ? queue_id : 0; rep_rxq = vfr_bp->rx_queues[que];