From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id A0EC4A034E; Wed, 23 Feb 2022 01:00:58 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 2A4DF40DF6; Wed, 23 Feb 2022 01:00:58 +0100 (CET) Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by mails.dpdk.org (Postfix) with ESMTP id D8AB94067B for ; Wed, 23 Feb 2022 01:00:56 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1645574457; x=1677110457; h=from:to:cc:subject:date:message-id; bh=qB++VPchO+gAUYcp+4Vd44lOKvGvdMFNWAD8Oj+J9p0=; b=ZCIxOdV/+5R8YPnxGL14zN1HUiYzYzk7f6BxGNBhmJG8SLpS7htCwj27 GVHwUHOlP4Qfee1LJJnX7sz9CVsmgCaw1+KDtnRQAkoxl07ziuGAj2pXP VLkI3ztybdmaXmxcNo1KEPBymn7W0nao7J46BXXN7Pz5TN1LfGwD7U0d1 cjF/2BDCxjxt7jLBPR3f+VkKWqcBvVfCAmQwg0AbpVSjG0wQHIFvd8WpY xgoYGXxmxHTqyy080j0GN1guS8vYAmj8gdhl1GWapF2hPEp028WBuhwLQ glFAj3EaWDvk/JUXOIxgKzwpPRC8tUZM2GXwOfADGniDtvDJ6fThIvsfz A==; X-IronPort-AV: E=McAfee;i="6200,9189,10266"; a="249426425" X-IronPort-AV: E=Sophos;i="5.88,389,1635231600"; d="scan'208";a="249426425" Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 22 Feb 2022 16:00:55 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.88,389,1635231600"; d="scan'208";a="573624159" Received: from skx-5gnr-sc12-4.sc.intel.com ([172.25.69.210]) by orsmga001.jf.intel.com with ESMTP; 22 Feb 2022 16:00:55 -0800 From: Nicolas Chautru To: dev@dpdk.org, gakhil@marvell.com Cc: john.mcnamara@intel.com, sean.morrissey@intel.com, trix@redhat.com, Nicolas Chautru Subject: [PATCH v1] baseband/acc100: avoid out-of-bounds access corner cases Date: Tue, 22 Feb 2022 15:43:36 -0800 Message-Id: <1645573416-165364-1-git-send-email-nicolas.chautru@intel.com> X-Mailer: git-send-email 1.8.3.1 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Coverity issue: 375803, 375813, 375819, 375827, 375831 The actual maximum number of gather pointers should have been limited Fixes: 5ad5060f8f7a ("baseband/acc100: add LDPC processing functions") Signed-off-by: Nicolas Chautru --- drivers/baseband/acc100/rte_acc100_pmd.c | 3 +-- drivers/baseband/acc100/rte_acc100_pmd.h | 1 + 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/baseband/acc100/rte_acc100_pmd.c b/drivers/baseband/acc100/rte_acc100_pmd.c index 1c6080f..cc69c76 100644 --- a/drivers/baseband/acc100/rte_acc100_pmd.c +++ b/drivers/baseband/acc100/rte_acc100_pmd.c @@ -1460,8 +1460,7 @@ next_triplet++; while (cb_len > 0) { - if (next_triplet < ACC100_DMA_MAX_NUM_POINTERS && - m->next != NULL) { + if (next_triplet < ACC100_DMA_MAX_NUM_POINTERS_IN && m->next != NULL) { m = m->next; *seg_total_left = rte_pktmbuf_data_len(m); diff --git a/drivers/baseband/acc100/rte_acc100_pmd.h b/drivers/baseband/acc100/rte_acc100_pmd.h index 03ed0b3..cbcece2 100644 --- a/drivers/baseband/acc100/rte_acc100_pmd.h +++ b/drivers/baseband/acc100/rte_acc100_pmd.h @@ -113,6 +113,7 @@ #define ACC100_SW_RING_MEM_ALLOC_ATTEMPTS 5 #define ACC100_MAX_QUEUE_DEPTH 1024 #define ACC100_DMA_MAX_NUM_POINTERS 14 +#define ACC100_DMA_MAX_NUM_POINTERS_IN 7 #define ACC100_DMA_DESC_PADDING 8 #define ACC100_FCW_PADDING 12 #define ACC100_DESC_FCW_OFFSET 192 -- 1.8.3.1