From 7a7fa2891df4ec4af0c34f3bbd203e1376e83951 Mon Sep 17 00:00:00 2001 From: Nelson Escobar Date: Thu, 17 Mar 2016 15:49:58 -0700 Subject: [PATCH 15/22] enic: fix crash when allocating too many queues Add checks to make sure we don't try to allocate more tx or rx queues than we support. Fixes: fefed3d1e62c ("enic: new driver") Signed-off-by: Nelson Escobar Reviewed-by: John Daley --- drivers/net/enic/enic_ethdev.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/net/enic/enic_ethdev.c b/drivers/net/enic/enic_ethdev.c index 6f2ada5..6c3c734 100644 --- a/drivers/net/enic/enic_ethdev.c +++ b/drivers/net/enic/enic_ethdev.c @@ -174,6 +174,13 @@ static int enicpmd_dev_tx_queue_setup(struct rte_eth_dev *eth_dev, struct enic *enic = pmd_priv(eth_dev); ENICPMD_FUNC_TRACE(); + if (queue_idx >= ENIC_WQ_MAX) { + dev_err(enic, + "Max number of TX queues exceeded. Max is %d\n", + ENIC_WQ_MAX); + return -EINVAL; + } + eth_dev->data->tx_queues[queue_idx] = (void *)&enic->wq[queue_idx]; ret = enic_alloc_wq(enic, queue_idx, socket_id, nb_desc); @@ -262,6 +269,13 @@ static int enicpmd_dev_rx_queue_setup(struct rte_eth_dev *eth_dev, struct enic *enic = pmd_priv(eth_dev); ENICPMD_FUNC_TRACE(); + if (queue_idx >= ENIC_RQ_MAX) { + dev_err(enic, + "Max number of RX queues exceeded. Max is %d\n", + ENIC_RQ_MAX); + return -EINVAL; + } + eth_dev->data->rx_queues[queue_idx] = (void *)&enic->rq[queue_idx]; ret = enic_alloc_rq(enic, queue_idx, socket_id, mp, nb_desc); -- 1.9.1