[PATCH 14/16] crypto/cnxk: bound SG iovec index in mbuf walk

[Tejasree Kondoj]

From: Rupesh Chiluka <rchiluka at marvell.com>

prepare_iov_from_pkt() and prepare_iov_from_pkt_inplace() rely on
nb_segs to limit the number of segments written to the on-stack iovec.
Also check the index against ROC_MAX_SG_CNT inside the walk, so a chain
longer than nb_segs reports cannot overrun the buffer.

Signed-off-by: Rupesh Chiluka <rchiluka at marvell.com>
---
 drivers/crypto/cnxk/cnxk_se.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/crypto/cnxk/cnxk_se.h b/drivers/crypto/cnxk/cnxk_se.h
index a3c3c3ce86..b93a2bfaf8 100644
--- a/drivers/crypto/cnxk/cnxk_se.h
+++ b/drivers/crypto/cnxk/cnxk_se.h
@@ -2720,6 +2720,11 @@ prepare_iov_from_pkt(struct rte_mbuf *pkt, struct roc_se_iov_ptr *iovec, uint32_
 		if (!seg_size)
 			break;
 
+		if (unlikely(index >= ROC_MAX_SG_CNT)) {
+			plt_dp_err("Number of segments exceeds max supported (%u)", ROC_MAX_SG_CNT);
+			return 1;
+		}
+
 		iovec->bufs[index].vaddr = seg_data;
 		iovec->bufs[index].size = seg_size;
 
@@ -2776,6 +2781,11 @@ prepare_iov_from_pkt_inplace(struct rte_mbuf *pkt,
 		if (!seg_size)
 			break;
 
+		if (unlikely(index >= ROC_MAX_SG_CNT)) {
+			plt_dp_err("Number of segments exceeds max supported (%u)", ROC_MAX_SG_CNT);
+			return 1;
+		}
+
 		iovec->bufs[index].vaddr = seg_data;
 		iovec->bufs[index].size = seg_size;
 
-- 
2.43.0