[PATCH v5 35/45] net/sxe2: validate representor ID against VF count

[liujie5 at linkdatatechnology.com]

From: Jie Liu <liujie5 at linkdatatechnology.com>

sxe2_switchdev_repr_private_data_init() indexes
parent_adapter->repr_ctxt.repr_vf_id[repr_id] without checking that
repr_id is within the number of configured VFs, which can access out
of bounds when an invalid representor ID is passed.

Add a bounds check on repr_id against repr_ctxt.nb_vf and return
-EINVAL on the error path.

Fixes: 635084db5d57 ("net/sxe2: support VF representors")
Cc: stable at dpdk.org
Cc: stephen at networkplumber.org
Signed-off-by: Jie Liu <liujie5 at linkdatatechnology.com>
---
 drivers/net/sxe2/sxe2_switchdev.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/sxe2/sxe2_switchdev.c b/drivers/net/sxe2/sxe2_switchdev.c
index efb1468b91..d0304ccc94 100644
--- a/drivers/net/sxe2/sxe2_switchdev.c
+++ b/drivers/net/sxe2/sxe2_switchdev.c
@@ -312,6 +312,12 @@ int32_t sxe2_switchdev_repr_private_data_init(struct rte_eth_dev *dev,
 	repr_priv_data->repr_q_id = repr_id;
 	repr_priv_data->repr_pf_id = parent_adapter->pf_idx;
 	repr_priv_data->repr_vf_id = repr_id;
+	if (repr_id >= parent_adapter->repr_ctxt.nb_vf) {
+		PMD_LOG_ERR(INIT, "repr_id %u exceed max vf %u",
+			repr_id, parent_adapter->repr_ctxt.nb_vf);
+		ret = -EINVAL;
+		goto l_free;
+	}
 	repr_priv_data->repr_vf_primary_vsi_id =
 		parent_adapter->repr_ctxt.repr_vf_id[repr_id].kernel_vsi_id;
 	repr_priv_data->repr_vf_backup_vsi_id =
-- 
2.52.0