[dpdk-dev] [PATCH] common/cnxk: fix Coverity issues

[dpdk-dev] [PATCH] common/cnxk: fix Coverity issues

[psatheesh]

From: Satheesh Paul <psatheesh@marvell.com>

Fix Out-of-bounds access and remove dead code
reported by Coverity.

Coverity issue: 384431, 384439, 380992
Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
Fixes: da1ec39060b2 ("common/cnxk: delay inline device RQ enable to dev start")
Cc: stable@dpdk.org

Signed-off-by: Satheesh Paul <psatheesh@marvell.com>
Reviewed-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
Reviewed-by: Harman Kalra <hkalra@marvell.com>
---
 drivers/common/cnxk/roc_dev.c     | 2 ++
 drivers/common/cnxk/roc_nix_inl.c | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index 084343c3b4..14aff233d5 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -502,6 +502,8 @@ pf_vf_mbox_send_up_msg(struct dev *dev, void *rec_msg)
 	size_t size;
 
 	size = PLT_ALIGN(mbox_id2size(msg->hdr.id), MBOX_MSG_ALIGN);
+	if (size < sizeof(struct mbox_msghdr))
+		return;
 	/* Send UP message to all VF's */
 	for (vf = 0; vf < vf_mbox->ndevs; vf++) {
 		/* VF active */
diff --git a/drivers/common/cnxk/roc_nix_inl.c b/drivers/common/cnxk/roc_nix_inl.c
index a205c658e9..7dbeae5017 100644
--- a/drivers/common/cnxk/roc_nix_inl.c
+++ b/drivers/common/cnxk/roc_nix_inl.c
@@ -677,8 +677,7 @@ roc_nix_reassembly_configure(uint32_t max_wait_time, uint16_t max_frags)
 		return -EFAULT;
 
 	PLT_SET_USED(max_frags);
-	if (idev == NULL)
-		return -ENOTSUP;
+
 	roc_cpt = idev->cpt;
 	if (!roc_cpt) {
 		plt_err("Cannot support inline inbound, cryptodev not probed");
-- 
2.39.2

Re: [dpdk-dev] [PATCH] common/cnxk: fix Coverity issues

[Jerin Jacob]

On Wed, Feb 28, 2024 at 12:25 PM <psatheesh@marvell.com> wrote:
>
> From: Satheesh Paul <psatheesh@marvell.com>


Please change the subject "common/cnxk: fix Coverity issues" and align
on what is fixed and send as separate patches.



> Fix Out-of-bounds access and remove dead code
> reported by Coverity.
>
> Coverity issue: 384431, 384439, 380992
> Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
> Fixes: da1ec39060b2 ("common/cnxk: delay inline device RQ enable to dev start")
> Cc: stable@dpdk.org
>
> Signed-off-by: Satheesh Paul <psatheesh@marvell.com>
> Reviewed-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
> Reviewed-by: Harman Kalra <hkalra@marvell.com>
> ---
>  drivers/common/cnxk/roc_dev.c     | 2 ++
>  drivers/common/cnxk/roc_nix_inl.c | 3 +--
>  2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
> index 084343c3b4..14aff233d5 100644
> --- a/drivers/common/cnxk/roc_dev.c
> +++ b/drivers/common/cnxk/roc_dev.c
> @@ -502,6 +502,8 @@ pf_vf_mbox_send_up_msg(struct dev *dev, void *rec_msg)
>         size_t size;
>
>         size = PLT_ALIGN(mbox_id2size(msg->hdr.id), MBOX_MSG_ALIGN);
> +       if (size < sizeof(struct mbox_msghdr))
> +               return;
>         /* Send UP message to all VF's */
>         for (vf = 0; vf < vf_mbox->ndevs; vf++) {
>                 /* VF active */
> diff --git a/drivers/common/cnxk/roc_nix_inl.c b/drivers/common/cnxk/roc_nix_inl.c
> index a205c658e9..7dbeae5017 100644
> --- a/drivers/common/cnxk/roc_nix_inl.c
> +++ b/drivers/common/cnxk/roc_nix_inl.c
> @@ -677,8 +677,7 @@ roc_nix_reassembly_configure(uint32_t max_wait_time, uint16_t max_frags)
>                 return -EFAULT;
>
>         PLT_SET_USED(max_frags);
> -       if (idev == NULL)
> -               return -ENOTSUP;
> +
>         roc_cpt = idev->cpt;
>         if (!roc_cpt) {
>                 plt_err("Cannot support inline inbound, cryptodev not probed");
> --
> 2.39.2
>

[dpdk-dev] [PATCH v2 1/2] common/cnxk: remove dead code

[psatheesh]

From: Satheesh Paul <psatheesh@marvell.com>

Removed dead code reported by Coverity.

Coverity issue: 380992
Fixes: da1ec39060b2 ("common/cnxk: delay inline device RQ enable to dev start")
Cc: stable@dpdk.org

Signed-off-by: Satheesh Paul <psatheesh@marvell.com>
Reviewed-by: Nithin Dabilpuram <ndabilpuram@marvell.com>
---
v2:
* Split the patch and updated commit message.

 drivers/common/cnxk/roc_nix_inl.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/common/cnxk/roc_nix_inl.c b/drivers/common/cnxk/roc_nix_inl.c
index a205c658e9..7dbeae5017 100644
--- a/drivers/common/cnxk/roc_nix_inl.c
+++ b/drivers/common/cnxk/roc_nix_inl.c
@@ -677,8 +677,7 @@ roc_nix_reassembly_configure(uint32_t max_wait_time, uint16_t max_frags)
 		return -EFAULT;
 
 	PLT_SET_USED(max_frags);
-	if (idev == NULL)
-		return -ENOTSUP;
+
 	roc_cpt = idev->cpt;
 	if (!roc_cpt) {
 		plt_err("Cannot support inline inbound, cryptodev not probed");
-- 
2.39.2

[dpdk-dev] [PATCH v2 2/2] common/cnxk: fix possible out-of-bounds access

[psatheesh]

From: Satheesh Paul <psatheesh@marvell.com>

The subtraction expression in mbox_memcpy() can wrap around
causing an out-of-bounds access. Added a check on 'size' to
fix this.

Coverity issue: 384431, 384439
Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
Cc: stable@dpdk.org

Signed-off-by: Satheesh Paul <psatheesh@marvell.com>
Reviewed-by: Harman Kalra <hkalra@marvell.com>
---
 drivers/common/cnxk/roc_dev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index 084343c3b4..14aff233d5 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -502,6 +502,8 @@ pf_vf_mbox_send_up_msg(struct dev *dev, void *rec_msg)
 	size_t size;
 
 	size = PLT_ALIGN(mbox_id2size(msg->hdr.id), MBOX_MSG_ALIGN);
+	if (size < sizeof(struct mbox_msghdr))
+		return;
 	/* Send UP message to all VF's */
 	for (vf = 0; vf < vf_mbox->ndevs; vf++) {
 		/* VF active */
-- 
2.39.2

Re: [dpdk-dev] [PATCH v2 2/2] common/cnxk: fix possible out-of-bounds access

[Jerin Jacob]

On Fri, Mar 1, 2024 at 9:05 AM <psatheesh@marvell.com> wrote:
>
> From: Satheesh Paul <psatheesh@marvell.com>
>
> The subtraction expression in mbox_memcpy() can wrap around
> causing an out-of-bounds access. Added a check on 'size' to
> fix this.
>
> Coverity issue: 384431, 384439
> Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
> Cc: stable@dpdk.org
>
> Signed-off-by: Satheesh Paul <psatheesh@marvell.com>
> Reviewed-by: Harman Kalra <hkalra@marvell.com>


Series applied to dpdk-next-net-mrvl/for-main. Thanks