From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by dpdk.org (Postfix) with ESMTP id 230224AC7 for ; Tue, 5 Jul 2016 08:10:32 +0200 (CEST) Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga101.fm.intel.com with ESMTP; 04 Jul 2016 23:10:32 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.26,578,1459839600"; d="scan'208";a="133938031" Received: from shvmail01.sh.intel.com ([10.239.29.42]) by fmsmga004.fm.intel.com with ESMTP; 04 Jul 2016 23:10:26 -0700 Received: from shecgisg004.sh.intel.com (shecgisg004.sh.intel.com [10.239.29.89]) by shvmail01.sh.intel.com with ESMTP id u656ANQW015105; Tue, 5 Jul 2016 14:10:23 +0800 Received: from shecgisg004.sh.intel.com (localhost [127.0.0.1]) by shecgisg004.sh.intel.com (8.13.6/8.13.6/SuSE Linux 0.8) with ESMTP id u656AJcA016290; Tue, 5 Jul 2016 14:10:21 +0800 Received: (from beileixi@localhost) by shecgisg004.sh.intel.com (8.13.6/8.13.6/Submit) id u656AJbY016286; Tue, 5 Jul 2016 14:10:19 +0800 From: Beilei Xing To: jingjing.wu@intel.com, michalx.k.jastrzebski@intel.com Cc: dev@dpdk.org, Beilei Xing Date: Tue, 5 Jul 2016 14:10:05 +0800 Message-Id: <1467699005-16235-4-git-send-email-beilei.xing@intel.com> X-Mailer: git-send-email 1.7.4.1 In-Reply-To: <1467699005-16235-1-git-send-email-beilei.xing@intel.com> References: <1467272056-14388-1-git-send-email-beilei.xing@intel.com> <1467699005-16235-1-git-send-email-beilei.xing@intel.com> Subject: [dpdk-dev] [PATCH v2 3/3] i40e: fix out-of-bounds access X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jul 2016 06:10:33 -0000 When calling i40e_flowtype_to_pctype in i40e_get_hash_filter_global_config and i40e_set_hash_filter_global_config, function i40e_flowtype_to_pctype will be possibly out-of-bounds accessed, because size of callee's array is 15. So judge flow type before calling i40e_flowtype_to_pctype. Meanwhile do the same change in other functions. Coverity issue: 37793, 37794 Fixes: 782c8c92f13f ("i40e: add hash configuration") Fixes: f2b2e2354bbd ("i40e: split function for hash and flow director input") Fixes: 98f055707685 ("i40e: configure input fields for RSS or flow director") Signed-off-by: Beilei Xing --- drivers/net/i40e/i40e_ethdev.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c index a1cad37..111a552 100644 --- a/drivers/net/i40e/i40e_ethdev.c +++ b/drivers/net/i40e/i40e_ethdev.c @@ -6908,6 +6908,9 @@ i40e_get_hash_filter_global_config(struct i40e_hw *hw, mask &= ~(1UL << i); /* Bit set indicats the coresponding flow type is supported */ g_cfg->valid_bit_mask[0] |= (1UL << i); + /* if flowtype is invalid, continue */ + if (!I40E_VALID_FLOW(i)) + continue; pctype = i40e_flowtype_to_pctype(i); reg = i40e_read_rx_ctl(hw, I40E_GLQF_HSYM(pctype)); if (reg & I40E_GLQF_HSYM_SYMH_ENA_MASK) @@ -6979,6 +6982,9 @@ i40e_set_hash_filter_global_config(struct i40e_hw *hw, if (!(mask0 & (1UL << i))) continue; mask0 &= ~(1UL << i); + /* if flowtype is invalid, continue */ + if (!I40E_VALID_FLOW(i)) + continue; pctype = i40e_flowtype_to_pctype(i); reg = (g_cfg->sym_hash_enable_mask[0] & (1UL << i)) ? I40E_GLQF_HSYM_SYMH_ENA_MASK : 0; @@ -7541,13 +7547,11 @@ i40e_hash_filter_inset_select(struct i40e_hw *hw, return -EINVAL; } - pctype = i40e_flowtype_to_pctype(conf->flow_type); - if (pctype == 0 || pctype > I40E_FILTER_PCTYPE_L2_PAYLOAD) { - PMD_DRV_LOG(ERR, "Not supported flow type (%u)", - conf->flow_type); + if (!I40E_VALID_FLOW(conf->flow_type)) { + PMD_DRV_LOG(ERR, "invalid flow_type input."); return -EINVAL; } - + pctype = i40e_flowtype_to_pctype(conf->flow_type); ret = i40e_parse_input_set(&input_set, pctype, conf->field, conf->inset_size); if (ret) { @@ -7612,12 +7616,11 @@ i40e_fdir_filter_inset_select(struct i40e_pf *pf, return -EINVAL; } - pctype = i40e_flowtype_to_pctype(conf->flow_type); - if (pctype == 0 || pctype > I40E_FILTER_PCTYPE_L2_PAYLOAD) { - PMD_DRV_LOG(ERR, "Not supported flow type (%u)", - conf->flow_type); + if (!I40E_VALID_FLOW(conf->flow_type)) { + PMD_DRV_LOG(ERR, "invalid flow_type input."); return -EINVAL; } + pctype = i40e_flowtype_to_pctype(conf->flow_type); ret = i40e_parse_input_set(&input_set, pctype, conf->field, conf->inset_size); if (ret) { -- 2.5.0