[PATCH 0/4] clean code for dmadev and hns3

[PATCH 0/4] clean code for dmadev and hns3

[Jie Hai]

This patch set make clean codes.

Chengwen Feng (4):
  ethdev: verify queue ID when Tx done cleanup
  net/hns3: verify reset type from firmware
  dmadev: fix potential null pointer access
  dmadev: clean code for verify parameter

 drivers/net/hns3/hns3_intr.c |  6 ++++++
 lib/dmadev/rte_dmadev.c      | 32 +++++++++++++++++++++-----------
 lib/ethdev/rte_ethdev.c      |  4 ++++
 3 files changed, 31 insertions(+), 11 deletions(-)

-- 
2.22.0

[PATCH 1/4] ethdev: verify queue ID when Tx done cleanup

[Jie Hai]

From: Chengwen Feng <fengchengwen@huawei.com>

Verify queue_id for rte_eth_tx_done_cleanup API.

Fixes: 44a718c457b5 ("ethdev: add API to free consumed buffers in Tx ring")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
---
 lib/ethdev/rte_ethdev.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/ethdev/rte_ethdev.c b/lib/ethdev/rte_ethdev.c
index f1c658f49e80..998deb5ab101 100644
--- a/lib/ethdev/rte_ethdev.c
+++ b/lib/ethdev/rte_ethdev.c
@@ -2823,6 +2823,10 @@ rte_eth_tx_done_cleanup(uint16_t port_id, uint16_t queue_id, uint32_t free_cnt)
 	RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, -ENODEV);
 	dev = &rte_eth_devices[port_id];
 
+	ret = eth_dev_validate_tx_queue(dev, queue_id);
+	if (ret != 0)
+		return ret;
+
 	if (*dev->dev_ops->tx_done_cleanup == NULL)
 		return -ENOTSUP;
 
-- 
2.22.0

[PATCH 2/4] net/hns3: verify reset type from firmware

[Jie Hai]

From: Chengwen Feng <fengchengwen@huawei.com>

Verify reset-type which get from firmware.

Fixes: 1c1eb759e9d7 ("net/hns3: support RAS process in Kunpeng 930")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
---
 drivers/net/hns3/hns3_intr.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/hns3/hns3_intr.c b/drivers/net/hns3/hns3_intr.c
index 26fa2eb951bc..86c44f7cc3bc 100644
--- a/drivers/net/hns3/hns3_intr.c
+++ b/drivers/net/hns3/hns3_intr.c
@@ -2252,6 +2252,12 @@ hns3_handle_module_error_data(struct hns3_hw *hw, uint32_t *buf,
 	sum_err_info = (struct hns3_sum_err_info *)&buf[offset++];
 	mod_num = sum_err_info->mod_num;
 	reset_type = sum_err_info->reset_type;
+
+	if (reset_type >= HNS3_MAX_RESET) {
+		hns3_err(hw, "invalid reset type = %u", reset_type);
+		return;
+	}
+
 	if (reset_type && reset_type != HNS3_NONE_RESET)
 		hns3_atomic_set_bit(reset_type, &hw->reset.request);
 
-- 
2.22.0

[PATCH 3/4] dmadev: fix potential null pointer access

[Jie Hai]

From: Chengwen Feng <fengchengwen@huawei.com>

When rte_dma_vchan_status(dev_id, vchan, NULL) is called, a null pointer
access is triggered.
This patch adds the null pointer checker.

Fixes: 5e0f85912754 ("dmadev: add channel status check for testing use")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
---
 lib/dmadev/rte_dmadev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dmadev/rte_dmadev.c b/lib/dmadev/rte_dmadev.c
index 845727210fab..60c3d8ebf68e 100644
--- a/lib/dmadev/rte_dmadev.c
+++ b/lib/dmadev/rte_dmadev.c
@@ -741,7 +741,7 @@ rte_dma_vchan_status(int16_t dev_id, uint16_t vchan, enum rte_dma_vchan_status *
 {
 	struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
 
-	if (!rte_dma_is_valid(dev_id))
+	if (!rte_dma_is_valid(dev_id) || status == NULL)
 		return -EINVAL;
 
 	if (vchan >= dev->data->dev_conf.nb_vchans) {
-- 
2.22.0

[PATCH 4/4] dmadev: clean code for verify parameter

[Jie Hai]

From: Chengwen Feng <fengchengwen@huawei.com>

Make sure to verify the 'dev_id' parameter before using them.
Note: there is no actual problem with the current code, but it is
recommended to clean it up.

Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
---
 lib/dmadev/rte_dmadev.c | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/lib/dmadev/rte_dmadev.c b/lib/dmadev/rte_dmadev.c
index 60c3d8ebf68e..4ba3b9380c5f 100644
--- a/lib/dmadev/rte_dmadev.c
+++ b/lib/dmadev/rte_dmadev.c
@@ -436,11 +436,12 @@ rte_dma_count_avail(void)
 int
 rte_dma_info_get(int16_t dev_id, struct rte_dma_info *dev_info)
 {
-	const struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
+	const struct rte_dma_dev *dev;
 	int ret;
 
 	if (!rte_dma_is_valid(dev_id) || dev_info == NULL)
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	if (*dev->dev_ops->dev_info_get == NULL)
 		return -ENOTSUP;
@@ -462,12 +463,13 @@ rte_dma_info_get(int16_t dev_id, struct rte_dma_info *dev_info)
 int
 rte_dma_configure(int16_t dev_id, const struct rte_dma_conf *dev_conf)
 {
-	struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
 	struct rte_dma_info dev_info;
+	struct rte_dma_dev *dev;
 	int ret;
 
 	if (!rte_dma_is_valid(dev_id) || dev_conf == NULL)
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	if (dev->data->dev_started != 0) {
 		RTE_DMA_LOG(ERR,
@@ -513,11 +515,12 @@ rte_dma_configure(int16_t dev_id, const struct rte_dma_conf *dev_conf)
 int
 rte_dma_start(int16_t dev_id)
 {
-	struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
+	struct rte_dma_dev *dev;
 	int ret;
 
 	if (!rte_dma_is_valid(dev_id))
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	if (dev->data->dev_conf.nb_vchans == 0) {
 		RTE_DMA_LOG(ERR, "Device %d must be configured first", dev_id);
@@ -545,11 +548,12 @@ rte_dma_start(int16_t dev_id)
 int
 rte_dma_stop(int16_t dev_id)
 {
-	struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
+	struct rte_dma_dev *dev;
 	int ret;
 
 	if (!rte_dma_is_valid(dev_id))
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	if (dev->data->dev_started == 0) {
 		RTE_DMA_LOG(WARNING, "Device %d already stopped", dev_id);
@@ -572,11 +576,12 @@ rte_dma_stop(int16_t dev_id)
 int
 rte_dma_close(int16_t dev_id)
 {
-	struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
+	struct rte_dma_dev *dev;
 	int ret;
 
 	if (!rte_dma_is_valid(dev_id))
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	/* Device must be stopped before it can be closed */
 	if (dev->data->dev_started == 1) {
@@ -600,13 +605,14 @@ int
 rte_dma_vchan_setup(int16_t dev_id, uint16_t vchan,
 		    const struct rte_dma_vchan_conf *conf)
 {
-	struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
 	struct rte_dma_info dev_info;
 	bool src_is_dev, dst_is_dev;
+	struct rte_dma_dev *dev;
 	int ret;
 
 	if (!rte_dma_is_valid(dev_id) || conf == NULL)
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	if (dev->data->dev_started != 0) {
 		RTE_DMA_LOG(ERR,
@@ -693,10 +699,11 @@ rte_dma_vchan_setup(int16_t dev_id, uint16_t vchan,
 int
 rte_dma_stats_get(int16_t dev_id, uint16_t vchan, struct rte_dma_stats *stats)
 {
-	const struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
+	const struct rte_dma_dev *dev;
 
 	if (!rte_dma_is_valid(dev_id) || stats == NULL)
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	if (vchan >= dev->data->dev_conf.nb_vchans &&
 	    vchan != RTE_DMA_ALL_VCHAN) {
@@ -715,11 +722,12 @@ rte_dma_stats_get(int16_t dev_id, uint16_t vchan, struct rte_dma_stats *stats)
 int
 rte_dma_stats_reset(int16_t dev_id, uint16_t vchan)
 {
-	struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
+	struct rte_dma_dev *dev;
 	int ret;
 
 	if (!rte_dma_is_valid(dev_id))
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	if (vchan >= dev->data->dev_conf.nb_vchans &&
 	    vchan != RTE_DMA_ALL_VCHAN) {
@@ -739,10 +747,11 @@ rte_dma_stats_reset(int16_t dev_id, uint16_t vchan)
 int
 rte_dma_vchan_status(int16_t dev_id, uint16_t vchan, enum rte_dma_vchan_status *status)
 {
-	struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
+	struct rte_dma_dev *dev;
 
 	if (!rte_dma_is_valid(dev_id) || status == NULL)
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	if (vchan >= dev->data->dev_conf.nb_vchans) {
 		RTE_DMA_LOG(ERR, "Device %u vchan %u out of range", dev_id, vchan);
@@ -804,12 +813,13 @@ dma_dump_capability(FILE *f, uint64_t dev_capa)
 int
 rte_dma_dump(int16_t dev_id, FILE *f)
 {
-	const struct rte_dma_dev *dev = &rte_dma_devices[dev_id];
+	const struct rte_dma_dev *dev;
 	struct rte_dma_info dev_info;
 	int ret;
 
 	if (!rte_dma_is_valid(dev_id) || f == NULL)
 		return -EINVAL;
+	dev = &rte_dma_devices[dev_id];
 
 	ret = rte_dma_info_get(dev_id, &dev_info);
 	if (ret != 0) {
-- 
2.22.0

Re: [PATCH 1/4] ethdev: verify queue ID when Tx done cleanup

[Andrew Rybchenko]

On 9/5/24 09:46, Jie Hai wrote:
> From: Chengwen Feng <fengchengwen@huawei.com>
> 
> Verify queue_id for rte_eth_tx_done_cleanup API.

If I'm not mistaken the function is considered data path API (fast).
If so, it should not validate it's parameters as in rte_eth_tx_burst().
It may be done under RTE_ETHDEV_DEBUG_TX only.

May be documentation should be fixed to highlight it.

And yes, current implementation looks inconsistent from this point of
view since port_id and presence of callback are checked.

Anyway motivation in the patch description is insufficient.

> 
> Fixes: 44a718c457b5 ("ethdev: add API to free consumed buffers in Tx ring")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
> ---
>   lib/ethdev/rte_ethdev.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/lib/ethdev/rte_ethdev.c b/lib/ethdev/rte_ethdev.c
> index f1c658f49e80..998deb5ab101 100644
> --- a/lib/ethdev/rte_ethdev.c
> +++ b/lib/ethdev/rte_ethdev.c
> @@ -2823,6 +2823,10 @@ rte_eth_tx_done_cleanup(uint16_t port_id, uint16_t queue_id, uint32_t free_cnt)
>   	RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, -ENODEV);
>   	dev = &rte_eth_devices[port_id];
>   
> +	ret = eth_dev_validate_tx_queue(dev, queue_id);
> +	if (ret != 0)
> +		return ret;
> +
>   	if (*dev->dev_ops->tx_done_cleanup == NULL)
>   		return -ENOTSUP;
>   

Re: [PATCH 1/4] ethdev: verify queue ID when Tx done cleanup

[Ferruh Yigit]

On 9/5/2024 8:33 AM, Andrew Rybchenko wrote:
> On 9/5/24 09:46, Jie Hai wrote:
>> From: Chengwen Feng <fengchengwen@huawei.com>
>>
>> Verify queue_id for rte_eth_tx_done_cleanup API.
> 
> If I'm not mistaken the function is considered data path API (fast).
> If so, it should not validate it's parameters as in rte_eth_tx_burst().
> It may be done under RTE_ETHDEV_DEBUG_TX only.
> 
> May be documentation should be fixed to highlight it.
> 
> And yes, current implementation looks inconsistent from this point of
> view since port_id and presence of callback are checked.
> 
> Anyway motivation in the patch description is insufficient.
> 

Hi Chengwen,

I agree with Andrew, to not add checks to the datapath function.

Can you please explain more why this check is needed at first place?
Is it for a specific usecase?

>>
>> Fixes: 44a718c457b5 ("ethdev: add API to free consumed buffers in Tx
>> ring")
>> Cc: stable@dpdk.org
>>
>> Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
>> ---
>>   lib/ethdev/rte_ethdev.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/lib/ethdev/rte_ethdev.c b/lib/ethdev/rte_ethdev.c
>> index f1c658f49e80..998deb5ab101 100644
>> --- a/lib/ethdev/rte_ethdev.c
>> +++ b/lib/ethdev/rte_ethdev.c
>> @@ -2823,6 +2823,10 @@ rte_eth_tx_done_cleanup(uint16_t port_id,
>> uint16_t queue_id, uint32_t free_cnt)
>>       RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, -ENODEV);
>>       dev = &rte_eth_devices[port_id];
>>   +    ret = eth_dev_validate_tx_queue(dev, queue_id);
>> +    if (ret != 0)
>> +        return ret;
>> +
>>       if (*dev->dev_ops->tx_done_cleanup == NULL)
>>           return -ENOTSUP;
>>   
> 

Re: [PATCH 1/4] ethdev: verify queue ID when Tx done cleanup

[fengchengwen]

On 2024/10/12 10:27, Ferruh Yigit wrote:
> On 9/5/2024 8:33 AM, Andrew Rybchenko wrote:
>> On 9/5/24 09:46, Jie Hai wrote:
>>> From: Chengwen Feng <fengchengwen@huawei.com>
>>>
>>> Verify queue_id for rte_eth_tx_done_cleanup API.
>>
>> If I'm not mistaken the function is considered data path API (fast).
>> If so, it should not validate it's parameters as in rte_eth_tx_burst().
>> It may be done under RTE_ETHDEV_DEBUG_TX only.
>>
>> May be documentation should be fixed to highlight it.
>>
>> And yes, current implementation looks inconsistent from this point of
>> view since port_id and presence of callback are checked.
>>
>> Anyway motivation in the patch description is insufficient.
>>
> 
> Hi Chengwen,
> 
> I agree with Andrew, to not add checks to the datapath function.
> 
> Can you please explain more why this check is needed at first place?
> Is it for a specific usecase?

Hi Ferruh,

It was triggered by our internal security review.
I think it's okay to add the check under RTE_ETHDEV_DEBUG_TX. and Haijie will send v2.

Thanks

> 
>>>
>>> Fixes: 44a718c457b5 ("ethdev: add API to free consumed buffers in Tx
>>> ring")
>>> Cc: stable@dpdk.org
>>>
>>> Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
>>> ---
>>>   lib/ethdev/rte_ethdev.c | 4 ++++
>>>   1 file changed, 4 insertions(+)
>>>
>>> diff --git a/lib/ethdev/rte_ethdev.c b/lib/ethdev/rte_ethdev.c
>>> index f1c658f49e80..998deb5ab101 100644
>>> --- a/lib/ethdev/rte_ethdev.c
>>> +++ b/lib/ethdev/rte_ethdev.c
>>> @@ -2823,6 +2823,10 @@ rte_eth_tx_done_cleanup(uint16_t port_id,
>>> uint16_t queue_id, uint32_t free_cnt)
>>>       RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, -ENODEV);
>>>       dev = &rte_eth_devices[port_id];
>>>   +    ret = eth_dev_validate_tx_queue(dev, queue_id);
>>> +    if (ret != 0)
>>> +        return ret;
>>> +
>>>       if (*dev->dev_ops->tx_done_cleanup == NULL)
>>>           return -ENOTSUP;
>>>   
>>
> 

Re: [PATCH 0/4] clean code for dmadev and hns3

[Jie Hai]

On 2024/9/5 14:46, Jie Hai wrote:
The patch set will be seperate into 3 part and resend, please see

patch[1/4]
https://patches.dpdk.org/project/dpdk/patch/20241012091437.21382-1-haijie1@huawei.com/

patch[2/4]
https://patches.dpdk.org/project/dpdk/patch/20241012091457.21554-1-haijie1@huawei.com/

patch[3/4][4/4]
https://patches.dpdk.org/project/dpdk/cover/20241012091735.24012-1-haijie1@huawei.com/

> This patch set make clean codes.
> 
> Chengwen Feng (4):
>    ethdev: verify queue ID when Tx done cleanup
>    net/hns3: verify reset type from firmware
>    dmadev: fix potential null pointer access
>    dmadev: clean code for verify parameter
> 
>   drivers/net/hns3/hns3_intr.c |  6 ++++++
>   lib/dmadev/rte_dmadev.c      | 32 +++++++++++++++++++++-----------
>   lib/ethdev/rte_ethdev.c      |  4 ++++
>   3 files changed, 31 insertions(+), 11 deletions(-)
>