DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH] net/enic: fix raw item length check
@ 2019-04-09  6:40 Hyong Youb Kim
  2019-04-09  6:40 ` Hyong Youb Kim
  2019-04-11 16:44 ` Ferruh Yigit
  0 siblings, 2 replies; 4+ messages in thread
From: Hyong Youb Kim @ 2019-04-09  6:40 UTC (permalink / raw)
  To: Ferruh Yigit; +Cc: dev, John Daley, Hyong Youb Kim

Currently, the raw item is always preceeded by a UDP header, and both
land in the L4 pattern buffer. So consider the UDP header size when
checking if the raw spec fits in the L4 buffer.

Coverity issue: 336796
Coverity issue: 336850
Fixes: 477959e6eeb0 ("net/enic: enable limited support for raw flow item")

Signed-off-by: Hyong Youb Kim <hyonkim@cisco.com>
Reviewed-by: John Daley <johndale@cisco.com>
---
 drivers/net/enic/enic_flow.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/enic/enic_flow.c b/drivers/net/enic/enic_flow.c
index 5924a01e3..32ebeff09 100644
--- a/drivers/net/enic/enic_flow.c
+++ b/drivers/net/enic/enic_flow.c
@@ -967,7 +967,8 @@ enic_copy_item_raw_v2(struct copy_item_args *arg)
 	if (!spec->relative || spec->offset != 0 || spec->search || spec->limit)
 		return EINVAL;
 	/* Need non-null pattern that fits within the NIC's filter pattern */
-	if (spec->length == 0 || spec->length > FILTER_GENERIC_1_KEY_LEN ||
+	if (spec->length == 0 ||
+	    spec->length + sizeof(struct udp_hdr) > FILTER_GENERIC_1_KEY_LEN ||
 	    !spec->pattern || !mask->pattern)
 		return EINVAL;
 	/*
-- 
2.16.2

^ permalink raw reply	[flat|nested] 4+ messages in thread

* [dpdk-dev] [PATCH] net/enic: fix raw item length check
  2019-04-09  6:40 [dpdk-dev] [PATCH] net/enic: fix raw item length check Hyong Youb Kim
@ 2019-04-09  6:40 ` Hyong Youb Kim
  2019-04-11 16:44 ` Ferruh Yigit
  1 sibling, 0 replies; 4+ messages in thread
From: Hyong Youb Kim @ 2019-04-09  6:40 UTC (permalink / raw)
  To: Ferruh Yigit; +Cc: dev, John Daley, Hyong Youb Kim

Currently, the raw item is always preceeded by a UDP header, and both
land in the L4 pattern buffer. So consider the UDP header size when
checking if the raw spec fits in the L4 buffer.

Coverity issue: 336796
Coverity issue: 336850
Fixes: 477959e6eeb0 ("net/enic: enable limited support for raw flow item")

Signed-off-by: Hyong Youb Kim <hyonkim@cisco.com>
Reviewed-by: John Daley <johndale@cisco.com>
---
 drivers/net/enic/enic_flow.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/enic/enic_flow.c b/drivers/net/enic/enic_flow.c
index 5924a01e3..32ebeff09 100644
--- a/drivers/net/enic/enic_flow.c
+++ b/drivers/net/enic/enic_flow.c
@@ -967,7 +967,8 @@ enic_copy_item_raw_v2(struct copy_item_args *arg)
 	if (!spec->relative || spec->offset != 0 || spec->search || spec->limit)
 		return EINVAL;
 	/* Need non-null pattern that fits within the NIC's filter pattern */
-	if (spec->length == 0 || spec->length > FILTER_GENERIC_1_KEY_LEN ||
+	if (spec->length == 0 ||
+	    spec->length + sizeof(struct udp_hdr) > FILTER_GENERIC_1_KEY_LEN ||
 	    !spec->pattern || !mask->pattern)
 		return EINVAL;
 	/*
-- 
2.16.2


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [dpdk-dev] [PATCH] net/enic: fix raw item length check
  2019-04-09  6:40 [dpdk-dev] [PATCH] net/enic: fix raw item length check Hyong Youb Kim
  2019-04-09  6:40 ` Hyong Youb Kim
@ 2019-04-11 16:44 ` Ferruh Yigit
  2019-04-11 16:44   ` Ferruh Yigit
  1 sibling, 1 reply; 4+ messages in thread
From: Ferruh Yigit @ 2019-04-11 16:44 UTC (permalink / raw)
  To: Hyong Youb Kim; +Cc: dev, John Daley

On 4/9/2019 7:40 AM, Hyong Youb Kim wrote:
> Currently, the raw item is always preceeded by a UDP header, and both
> land in the L4 pattern buffer. So consider the UDP header size when
> checking if the raw spec fits in the L4 buffer.
> 
> Coverity issue: 336796
> Coverity issue: 336850
> Fixes: 477959e6eeb0 ("net/enic: enable limited support for raw flow item")
> 
> Signed-off-by: Hyong Youb Kim <hyonkim@cisco.com>
> Reviewed-by: John Daley <johndale@cisco.com>

Applied to dpdk-next-net/master, thanks.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [dpdk-dev] [PATCH] net/enic: fix raw item length check
  2019-04-11 16:44 ` Ferruh Yigit
@ 2019-04-11 16:44   ` Ferruh Yigit
  0 siblings, 0 replies; 4+ messages in thread
From: Ferruh Yigit @ 2019-04-11 16:44 UTC (permalink / raw)
  To: Hyong Youb Kim; +Cc: dev, John Daley

On 4/9/2019 7:40 AM, Hyong Youb Kim wrote:
> Currently, the raw item is always preceeded by a UDP header, and both
> land in the L4 pattern buffer. So consider the UDP header size when
> checking if the raw spec fits in the L4 buffer.
> 
> Coverity issue: 336796
> Coverity issue: 336850
> Fixes: 477959e6eeb0 ("net/enic: enable limited support for raw flow item")
> 
> Signed-off-by: Hyong Youb Kim <hyonkim@cisco.com>
> Reviewed-by: John Daley <johndale@cisco.com>

Applied to dpdk-next-net/master, thanks.

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2019-04-11 16:44 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-09  6:40 [dpdk-dev] [PATCH] net/enic: fix raw item length check Hyong Youb Kim
2019-04-09  6:40 ` Hyong Youb Kim
2019-04-11 16:44 ` Ferruh Yigit
2019-04-11 16:44   ` Ferruh Yigit

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).