From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id A55A0A00C5; Fri, 8 May 2020 07:09:56 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 749841DC15; Fri, 8 May 2020 07:09:56 +0200 (CEST) Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by dpdk.org (Postfix) with ESMTP id 4D3241DBBA for ; Fri, 8 May 2020 07:09:54 +0200 (CEST) IronPort-SDR: wLEj8KPnVSPwq91E72H48pfO0z/iNq+a/3Uwjl4vuOLxsJNm3dBCpWzYRCx4HnuweLBOAygsQw LxejoFBzvQHw== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 May 2020 22:09:53 -0700 IronPort-SDR: Ehkg5EY9xkoHlCWEr80efYO/ChIpKTf/vIBKXXtLI2A9bFM8aF4CUQuUtbuyXDAA+bAN2Y/tVq Iv5lTs819E1g== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,366,1583222400"; d="scan'208,217";a="435556099" Received: from jguo15x-mobl.ccr.corp.intel.com (HELO [10.67.68.101]) ([10.67.68.101]) by orsmga005.jf.intel.com with ESMTP; 07 May 2020 22:09:51 -0700 To: alvinx.zhang@intel.com, dev@dpdk.org Cc: wei.zhao1@intel.com, xiaolong.ye@intel.com References: <20200507090853.16832-1-alvinx.zhang@intel.com> <20200507093156.18616-1-alvinx.zhang@intel.com> From: Jeff Guo Message-ID: <9a05472b-8fc3-2802-010f-5b3690000444@intel.com> Date: Fri, 8 May 2020 13:09:51 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.8.0 MIME-Version: 1.0 In-Reply-To: <20200507093156.18616-1-alvinx.zhang@intel.com> Content-Language: en-US Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Content-Filtered-By: Mailman/MimeDel 2.1.15 Subject: Re: [dpdk-dev] [PATCH v2] net/igc: fix memory illegal accesses X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On 5/7/2020 5:31 PM, alvinx.zhang@intel.com wrote: > From: Alvin Zhang > > Fix some out-of-bounds memory issues, they may lead to wrong results > or affect application stability. > > Fixes: bd3fcf0d0fa1 (net/igc: support RSS) > Cc: stable@dpdk.org > > Signed-off-by: Alvin Zhang > --- > > V2: update git log > > drivers/net/igc/igc_ethdev.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/igc/igc_ethdev.c b/drivers/net/igc/igc_ethdev.c > index 16d98c6..6ab3ee9 100644 > --- a/drivers/net/igc/igc_ethdev.c > +++ b/drivers/net/igc/igc_ethdev.c > @@ -2266,6 +2266,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > return -EINVAL; > } > > + RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); > + > /* set redirection table */ > for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { > union igc_rss_reta_reg reta, reg; > @@ -2278,7 +2280,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > IGC_RSS_RDT_REG_SIZE_MASK); > > /* if no need to update the register */ > - if (!mask) > + if (!mask || > + shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) > continue; > > /* check mask whether need to read the register value first */ > @@ -2289,6 +2292,7 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); > > /* update the register */ > + RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); > for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { > if (mask & (1u << j)) > reta.bytes[j] = > @@ -2318,6 +2322,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > return -EINVAL; > } > > + RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); > + > /* read redirection table */ > for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { > union igc_rss_reta_reg reta; > @@ -2330,10 +2336,12 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > IGC_RSS_RDT_REG_SIZE_MASK); > > /* if no need to read register */ > - if (!mask) > + if (!mask || > + shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) > continue; > > /* read register and get the queue index */ > + RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); > reta.dword = IGC_READ_REG_LE_VALUE(hw, > IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); > for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { Reviewed-by: Jeff Guo