[PATCH v3 13/17] net/dpaa2: add SG table walk upper bound in Rx path

Maxime Leroy
2026-03-06T13:32:31Z

If hardware or corrupt DMA data fails to set the FINAL bit in the
scatter-gather table, the while loop in eth_sg_fd_to_mbuf() walks
past the end of the SGT buffer. Add DPAA2_MAX_SGS as an upper bound.

Not tested, found by code review.

Fixes: 774e9ea91992 ("net/dpaa2: add support for multi seg buffers")
Cc: stable@dpdk.org

Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
---
drivers/net/dpaa2/dpaa2_rxtx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 8275ba9780..b316e23e87 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -335,7 +335,7 @@ eth_sg_fd_to_mbuf(const struct qbman_fd *fd,
(void **)&first_seg, 1, 1);
#endif
cur_seg = first_seg;
- while (!DPAA2_SG_IS_FINAL(sge)) {
+ while (!DPAA2_SG_IS_FINAL(sge) && i < DPAA2_MAX_SGS) {
sge = &sgt[i++];
sg_addr = (size_t)DPAA2_IOVA_TO_VADDR(
DPAA2_GET_FLE_ADDR(sge));
--
2.43.0