* [PATCH v1] net/iavf: fix taninted scalar
@ 2022-10-11 8:34 Steve Yang
2022-10-13 3:23 ` Zhang, Qi Z
0 siblings, 1 reply; 3+ messages in thread
From: Steve Yang @ 2022-10-11 8:34 UTC (permalink / raw)
To: dev; +Cc: jingjing.wu, beilei.xing, Steve Yang
Passing tainted expression "rss_meta->proto_hdrs.count" to
"iavf_refine_proto_hdrs", wich uses it as a loop boundary.
Replace tainted expression with a temp variable to avoid the
trainted scalar coverity warning.
Coverity issue: 381131
Fixes: f30157d988cf ("net/iavf: support PPPoL2TPv2oUDP RSS Hash")
Signed-off-by: Steve Yang <stevex.yang@intel.com>
---
drivers/net/iavf/iavf_hash.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/net/iavf/iavf_hash.c b/drivers/net/iavf/iavf_hash.c
index dea4e0aa0a..71c80d2c75 100644
--- a/drivers/net/iavf/iavf_hash.c
+++ b/drivers/net/iavf/iavf_hash.c
@@ -992,9 +992,10 @@ iavf_refine_proto_hdrs_l234(struct virtchnl_proto_hdrs *proto_hdrs,
uint64_t rss_type)
{
struct virtchnl_proto_hdr *hdr;
+ int phdrs_count = proto_hdrs->count;
int i;
- for (i = 0; i < proto_hdrs->count; i++) {
+ for (i = 0; i < phdrs_count; i++) {
hdr = &proto_hdrs->proto_hdr[i];
switch (hdr->type) {
case VIRTCHNL_PROTO_HDR_ETH:
@@ -1183,12 +1184,13 @@ iavf_refine_proto_hdrs_gtpu(struct virtchnl_proto_hdrs *proto_hdrs,
uint64_t rss_type)
{
struct virtchnl_proto_hdr *hdr;
+ int phdrs_count = proto_hdrs->count;
int i;
if (!(rss_type & RTE_ETH_RSS_GTPU))
return;
- for (i = 0; i < proto_hdrs->count; i++) {
+ for (i = 0; i < phdrs_count; i++) {
hdr = &proto_hdrs->proto_hdr[i];
switch (hdr->type) {
case VIRTCHNL_PROTO_HDR_GTPU_IP:
@@ -1208,6 +1210,7 @@ iavf_refine_proto_hdrs_by_pattern(struct virtchnl_proto_hdrs *proto_hdrs,
struct virtchnl_proto_hdr *hdr2;
int i, shift_count = 1;
int tun_lvl = proto_hdrs->tunnel_level;
+ int phdrs_count = proto_hdrs->count;
if (!(phint & IAVF_PHINT_GTPU_MSK) && !(phint & IAVF_PHINT_GRE))
return;
@@ -1217,7 +1220,7 @@ iavf_refine_proto_hdrs_by_pattern(struct virtchnl_proto_hdrs *proto_hdrs,
shift_count = 2;
/* shift headers layer */
- for (i = proto_hdrs->count - 1 + shift_count;
+ for (i = phdrs_count - 1 + shift_count;
i > shift_count - 1; i--) {
hdr1 = &proto_hdrs->proto_hdr[i];
hdr2 = &proto_hdrs->proto_hdr[i - shift_count];
@@ -1278,6 +1281,7 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs,
uint64_t phint)
{
struct virtchnl_proto_hdr *hdr, *hdr1;
+ int phdrs_count = proto_hdrs->count;
int i;
if (!(phint & IAVF_PHINT_L2TPV2) && !(phint & IAVF_PHINT_L2TPV2_LEN))
@@ -1285,7 +1289,7 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs,
if (proto_hdrs->tunnel_level == TUNNEL_LEVEL_INNER) {
/* shift headers layer */
- for (i = proto_hdrs->count - 1 + 1; i > 0; i--)
+ for (i = phdrs_count; i > 0; i--)
proto_hdrs->proto_hdr[i] = proto_hdrs->proto_hdr[i - 1];
/* adding outer ip header at layer 0 */
@@ -1298,7 +1302,7 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs,
else if (phint & IAVF_PHINT_OUTER_IPV6)
VIRTCHNL_SET_PROTO_HDR_TYPE(hdr1, IPV6);
} else {
- for (i = 0; i < proto_hdrs->count; i++) {
+ for (i = 0; i < phdrs_count; i++) {
hdr = &proto_hdrs->proto_hdr[i];
if (hdr->type == VIRTCHNL_PROTO_HDR_L2TPV2) {
if (phint & IAVF_PHINT_L2TPV2) {
@@ -1309,7 +1313,6 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs,
}
}
}
-
}
static void iavf_refine_proto_hdrs(struct virtchnl_proto_hdrs *proto_hdrs,
--
2.25.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* RE: [PATCH v1] net/iavf: fix taninted scalar
2022-10-11 8:34 [PATCH v1] net/iavf: fix taninted scalar Steve Yang
@ 2022-10-13 3:23 ` Zhang, Qi Z
0 siblings, 0 replies; 3+ messages in thread
From: Zhang, Qi Z @ 2022-10-13 3:23 UTC (permalink / raw)
To: Yang, SteveX, dev; +Cc: Wu, Jingjing, Xing, Beilei, Yang, SteveX
> -----Original Message-----
> From: Steve Yang <stevex.yang@intel.com>
> Sent: Tuesday, October 11, 2022 4:34 PM
> To: dev@dpdk.org
> Cc: Wu, Jingjing <jingjing.wu@intel.com>; Xing, Beilei
> <beilei.xing@intel.com>; Yang, SteveX <stevex.yang@intel.com>
> Subject: [PATCH v1] net/iavf: fix taninted scalar
>
> Passing tainted expression "rss_meta->proto_hdrs.count" to
> "iavf_refine_proto_hdrs", wich uses it as a loop boundary.
>
> Replace tainted expression with a temp variable to avoid the trainted scalar
> coverity warning.
>
> Coverity issue: 381131
> Fixes: f30157d988cf ("net/iavf: support PPPoL2TPv2oUDP RSS Hash")
>
> Signed-off-by: Steve Yang <stevex.yang@intel.com>
Acked-by: Qi Zhang <qi.z.zhang@intel.com>
Applied to dpdk-next-net-intel.
Thanks
Qi
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v1] net/iavf: fix taninted scalar
@ 2022-11-10 7:25 Steve Yang
0 siblings, 0 replies; 3+ messages in thread
From: Steve Yang @ 2022-11-10 7:25 UTC (permalink / raw)
To: dev; +Cc: jingjing.wu, beilei.xing, Steve Yang
tainted_data_downcast: Downcasting match_item->meta from void * to
struct virtchnl_proto_hdrs implies that the data that this pointer points
to is tainted.
var_assign_var: Assigning: proto_hdrs = match_item->meta.
Both are now tainted.
var_assign_var: Assigning: rss_meta->proto_hdrs = *proto_hdrs. Both are
now tainted.
Passing tainted expression "rss_meta->proto_hdrs.count" to
"iavf_refine_proto_hdrs", wich uses it as a loop boundary.
Removed temporary variable 'proto_hdrs', and copied whole memory of
match_item meta with exact structure size to avoid data downcast.
Coverity issue: 381131
Fixes: 91f27b2e39ab ("net/iavf: refactor RSS")
Signed-off-by: Steve Yang <stevex.yang@intel.com>
---
drivers/net/iavf/iavf_hash.c | 22 +++++++++-------------
1 file changed, 9 insertions(+), 13 deletions(-)
diff --git a/drivers/net/iavf/iavf_hash.c b/drivers/net/iavf/iavf_hash.c
index 67b05313eb..ae6fb38594 100644
--- a/drivers/net/iavf/iavf_hash.c
+++ b/drivers/net/iavf/iavf_hash.c
@@ -992,10 +992,9 @@ iavf_refine_proto_hdrs_l234(struct virtchnl_proto_hdrs *proto_hdrs,
uint64_t rss_type)
{
struct virtchnl_proto_hdr *hdr;
- int phdrs_count = proto_hdrs->count;
int i;
- for (i = 0; i < phdrs_count; i++) {
+ for (i = 0; i < proto_hdrs->count; i++) {
hdr = &proto_hdrs->proto_hdr[i];
switch (hdr->type) {
case VIRTCHNL_PROTO_HDR_ETH:
@@ -1184,13 +1183,12 @@ iavf_refine_proto_hdrs_gtpu(struct virtchnl_proto_hdrs *proto_hdrs,
uint64_t rss_type)
{
struct virtchnl_proto_hdr *hdr;
- int phdrs_count = proto_hdrs->count;
int i;
if (!(rss_type & RTE_ETH_RSS_GTPU))
return;
- for (i = 0; i < phdrs_count; i++) {
+ for (i = 0; i < proto_hdrs->count; i++) {
hdr = &proto_hdrs->proto_hdr[i];
switch (hdr->type) {
case VIRTCHNL_PROTO_HDR_GTPU_IP:
@@ -1210,7 +1208,6 @@ iavf_refine_proto_hdrs_by_pattern(struct virtchnl_proto_hdrs *proto_hdrs,
struct virtchnl_proto_hdr *hdr2;
int i, shift_count = 1;
int tun_lvl = proto_hdrs->tunnel_level;
- int phdrs_count = 0;
if (!(phint & IAVF_PHINT_GTPU_MSK) && !(phint & IAVF_PHINT_GRE))
return;
@@ -1219,9 +1216,8 @@ iavf_refine_proto_hdrs_by_pattern(struct virtchnl_proto_hdrs *proto_hdrs,
if (phint & IAVF_PHINT_LAYERS_MSK)
shift_count = 2;
- phdrs_count = proto_hdrs->count;
/* shift headers layer */
- for (i = phdrs_count - 1 + shift_count;
+ for (i = proto_hdrs->count - 1 + shift_count;
i > shift_count - 1; i--) {
hdr1 = &proto_hdrs->proto_hdr[i];
hdr2 = &proto_hdrs->proto_hdr[i - shift_count];
@@ -1282,7 +1278,6 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs,
uint64_t phint)
{
struct virtchnl_proto_hdr *hdr, *hdr1;
- int phdrs_count = proto_hdrs->count;
int i;
if (!(phint & IAVF_PHINT_L2TPV2) && !(phint & IAVF_PHINT_L2TPV2_LEN))
@@ -1290,7 +1285,7 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs,
if (proto_hdrs->tunnel_level == TUNNEL_LEVEL_INNER) {
/* shift headers layer */
- for (i = phdrs_count; i > 0; i--)
+ for (i = proto_hdrs->count; i > 0; i--)
proto_hdrs->proto_hdr[i] = proto_hdrs->proto_hdr[i - 1];
/* adding outer ip header at layer 0 */
@@ -1303,7 +1298,7 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs,
else if (phint & IAVF_PHINT_OUTER_IPV6)
VIRTCHNL_SET_PROTO_HDR_TYPE(hdr1, IPV6);
} else {
- for (i = 0; i < phdrs_count; i++) {
+ for (i = 0; i < proto_hdrs->count; i++) {
hdr = &proto_hdrs->proto_hdr[i];
if (hdr->type == VIRTCHNL_PROTO_HDR_L2TPV2) {
if (phint & IAVF_PHINT_L2TPV2) {
@@ -1427,7 +1422,6 @@ iavf_hash_parse_action(struct iavf_pattern_match_item *match_item,
uint64_t pattern_hint, struct iavf_rss_meta *rss_meta,
struct rte_flow_error *error)
{
- struct virtchnl_proto_hdrs *proto_hdrs;
enum rte_flow_action_type action_type;
const struct rte_flow_action_rss *rss;
const struct rte_flow_action *action;
@@ -1488,8 +1482,10 @@ iavf_hash_parse_action(struct iavf_pattern_match_item *match_item,
return rte_flow_error_set(error, ENOTSUP,
RTE_FLOW_ERROR_TYPE_ACTION,
action, "RSS type not supported");
- proto_hdrs = match_item->meta;
- rss_meta->proto_hdrs = *proto_hdrs;
+
+ memcpy(&rss_meta->proto_hdrs, match_item->meta,
+ sizeof(struct virtchnl_proto_hdrs));
+
iavf_refine_proto_hdrs(&rss_meta->proto_hdrs,
rss_type, pattern_hint);
break;
--
2.25.1
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-11-10 7:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-11 8:34 [PATCH v1] net/iavf: fix taninted scalar Steve Yang
2022-10-13 3:23 ` Zhang, Qi Z
2022-11-10 7:25 Steve Yang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).