From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <nhorman@tuxdriver.com>
Received: from smtp.tuxdriver.com (charlotte.tuxdriver.com [70.61.120.58])
 by dpdk.org (Postfix) with ESMTP id 38D9A4CA1
 for <dev@dpdk.org>; Fri,  6 Apr 2018 13:19:11 +0200 (CEST)
Received: from cpe-2606-a000-111b-40b7-640c-26a-4e16-9225.dyn6.twc.com
 ([2606:a000:111b:40b7:640c:26a:4e16:9225] helo=localhost)
 by smtp.tuxdriver.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.63)
 (envelope-from <nhorman@tuxdriver.com>)
 id 1f4POV-0001Tx-CV; Fri, 06 Apr 2018 07:19:07 -0400
Date: Fri, 6 Apr 2018 07:18:26 -0400
From: Neil Horman <nhorman@tuxdriver.com>
To: Stephen Hemminger <stephen@networkplumber.org>
Cc: ferruh.yigit@intel.com, dev@dpdk.org
Message-ID: <20180406111826.GA19958@hmswarspite.think-freely.org>
References: <20180405083618.61509f5d@xeon-e3>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20180405083618.61509f5d@xeon-e3>
User-Agent: Mutt/1.9.2 (2017-12-15)
X-Spam-Score: -2.9 (--)
X-Spam-Status: No
Subject: Re: [dpdk-dev] [RFT] vmxnet3: coverity reported defect
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://dpdk.org/ml/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://dpdk.org/ml/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://dpdk.org/ml/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
X-List-Received-Date: Fri, 06 Apr 2018 11:19:11 -0000

On Thu, Apr 05, 2018 at 08:36:18AM -0700, Stephen Hemminger wrote:
> I noticed Coverity defect in DPDK number 124563 was assigned to me.
> 
> It looks like vmxnet3 driver code doesn't handle case where host incorrectly
> sends a frame with out setting SOP bit in first segment. This would lead to
> rxq->start_seq being NULL.
> 
> Maybe something like this would fix it.  I don't have VMware (or time) to test.
> 
> diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
> index 57557492e0f5..3118d94add90 100644
> --- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
> +++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
> @@ -813,6 +813,13 @@ vmxnet3_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
>  
>  			RTE_ASSERT(rxd->btype == VMXNET3_RXD_BTYPE_BODY);
>  
> +			if (unlikely(start == NULL)) {
> +				PMD_RX_LOG(ERR, "Missing sop");
> +
> +				rte_pktmbuf_free_seg(rxm);
> +				goto rcd_done;
> +			}
> +
>  			start->pkt_len += rxm->data_len;
>  			start->nb_segs++;
>  
This looks reasonable to me, though my vmware instance is down at the moment, so
I'm unable to test
> 
> PS: the email for the VMXNET3 maintainer  Shrikrishna Khare <skhare@vmware.com> bounces.
> 
I think it needs to be updated to point at pv-drivers@vmware.com, thats what
they use in the kernel these days

Neil