[PATCH v2 29/70] net/ice/base: fix array overflow in add switch recipe code

Qi Zhang qi.z.zhang at intel.com
Mon Aug 15 09:31:25 CEST 2022


The array indexes in this function are used with a zero index in the
fv_idx table, and with a +1 index in the lkup_idx arrays. The code
was using the lookup index for the field vector in only one place in
this function, but the code was never used after this point so just
remove the bad line.

This was caught by the undefined behavior sanitizer.

Fixes: fed0c5ca5f19 ("net/ice/base: support programming a new switch recipe")
Cc: stable at dpdk.org

Signed-off-by: Jesse Brandeburg <jesse.brandeburg at intel.com>
Signed-off-by: Qi Zhang <qi.z.zhang at intel.com>
---
 drivers/net/ice/base/ice_switch.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/ice/base/ice_switch.c b/drivers/net/ice/base/ice_switch.c
index e59d191c46..b8e733f539 100644
--- a/drivers/net/ice/base/ice_switch.c
+++ b/drivers/net/ice/base/ice_switch.c
@@ -7315,7 +7315,6 @@ ice_add_sw_recipe(struct ice_hw *hw, struct ice_sw_recipe *rm,
 		last_chain_entry->chain_idx = ICE_INVAL_CHAIN_IND;
 		LIST_FOR_EACH_ENTRY(entry, &rm->rg_list, ice_recp_grp_entry,
 				    l_entry) {
-			last_chain_entry->fv_idx[i] = entry->chain_idx;
 			buf[recps].content.lkup_indx[i] = entry->chain_idx;
 			buf[recps].content.mask[i++] = CPU_TO_LE16(0xFFFF);
 			ice_set_bit(entry->rid, rm->r_bitmap);
-- 
2.31.1



More information about the stable mailing list