[PATCH] net/af_packet: fix qpairs argument upper bound check

[Denis Sergeev]

The qpairs vdev argument parsed via atoi() is stored in an
unsigned int. A negative input such as "-1" wraps to UINT_MAX,
passes the existing "< 1" check, and reaches
rte_pmd_init_internals() as nb_queues. This causes excessive
socket and memory allocation in the per-queue loop.

Add an upper bound check against RTE_MAX_QUEUES_PER_PORT.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: ccd37d341e8d ("net/af_packet: remove queue number limitation")

Signed-off-by: Denis Sergeev <denserg.edu at gmail.com>
---
 drivers/net/af_packet/rte_eth_af_packet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/af_packet/rte_eth_af_packet.c b/drivers/net/af_packet/rte_eth_af_packet.c
index 0ee94e71ea..ebf015dd9a 100644
--- a/drivers/net/af_packet/rte_eth_af_packet.c
+++ b/drivers/net/af_packet/rte_eth_af_packet.c
@@ -1169,7 +1169,7 @@ rte_eth_from_packet(struct rte_vdev_device *dev,
 		pair = &kvlist->pairs[k_idx];
 		if (strstr(pair->key, ETH_AF_PACKET_NUM_Q_ARG) != NULL) {
 			qpairs = atoi(pair->value);
-			if (qpairs < 1) {
+			if (qpairs < 1 || qpairs > RTE_MAX_QUEUES_PER_PORT) {
 				PMD_LOG(ERR,
 					"%s: invalid qpairs value",
 				        name);
-- 
2.50.1