i40e: fix idx validation in i40e_validate_queue_map

JIRA: https://issues.redhat.com/browse/RHEL-123809
CVE: CVE-2025-39972

commit aa68d3c
Author: Lukasz Czapnik <lukasz.czapnik@intel.com>
Date:   Wed Aug 13 12:45:12 2025 +0200

    i40e: fix idx validation in i40e_validate_queue_map

    Ensure idx is within range of active/initialized TCs when iterating over
    vf->ch[idx] in i40e_validate_queue_map().

    Fixes: c27eac4 ("i40e: Enable ADq and create queue channel/s on VF")
    Cc: stable@vger.kernel.org
    Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Tested-by: Kamakshi Nellore <nellorex.kamakshi@intel.com> (A Contingent Worker at Intel)
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>

Signed-off-by: Michal Schmidt <mschmidt@redhat.com>

Author: michich

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c

@@ -2469,8 +2469,10 @@ static int i40e_validate_queue_map(struct i40e_vf *vf, u16 vsi_id,
 	u16 vsi_queue_id, queue_id;
 
 	for_each_set_bit(vsi_queue_id, &queuemap, I40E_MAX_VSI_QP) {
-		if (vf->adq_enabled) {
-			vsi_id = vf->ch[vsi_queue_id / I40E_MAX_VF_VSI].vsi_id;
+		u16 idx = vsi_queue_id / I40E_MAX_VF_VSI;
+
+		if (vf->adq_enabled && idx < vf->num_tc) {
+			vsi_id = vf->ch[idx].vsi_id;
 			queue_id = (vsi_queue_id % I40E_DEFAULT_QUEUES_PER_VF);
 		} else {
 			queue_id = vsi_queue_id;