From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id C9BAD46F5B; Tue, 23 Sep 2025 16:05:46 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id B9904402CB; Tue, 23 Sep 2025 16:05:46 +0200 (CEST) Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178]) by mails.dpdk.org (Postfix) with ESMTP id 6CEF3402B3 for ; Tue, 23 Sep 2025 16:05:45 +0200 (CEST) Received: by inbox.dpdk.org (Postfix, from userid 33) id 6068C46F5C; Tue, 23 Sep 2025 16:05:45 +0200 (CEST) From: bugzilla@dpdk.org To: dev@dpdk.org Subject: [DPDK/ethdev Bug 1791] cnxk driver reference past requested xstat array Date: Tue, 23 Sep 2025 14:05:45 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: DPDK X-Bugzilla-Component: ethdev X-Bugzilla-Version: 25.07 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: stephen@networkplumber.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: Normal X-Bugzilla-Assigned-To: dev@dpdk.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: multipart/alternative; boundary=17586363450.dCd354E.486142 Content-Transfer-Encoding: 7bit X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org --17586363450.dCd354E.486142 Date: Tue, 23 Sep 2025 16:05:45 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All https://bugs.dpdk.org/show_bug.cgi?id=3D1791 Bug ID: 1791 Summary: cnxk driver reference past requested xstat array Product: DPDK Version: 25.07 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: Normal Component: ethdev Assignee: dev@dpdk.org Reporter: stephen@networkplumber.org Target Milestone: --- Because the cnxk driver ignores the limit arguement in some functions such = as xstat_names_get(). If the application asks for only some of the values in t= he xstats then an out of bounds reference is possible. Something like: struct rte_esth_xstat_name names[20]; rte_eth_xstat_get_names(port_id, names, 20); will cause out of bound array reference down here: int roc_nix_xstats_names_get(struct roc_nix *roc_nix, struct roc_nix_xstat_name *xstats_names, unsigned int limit) { struct nix *nix =3D roc_nix_to_nix_priv(roc_nix); struct idev_cfg *idev =3D idev_get_cfg(); uint64_t i, count =3D 0; PLT_SET_USED(limit); for (i =3D 0; i < CNXK_NIX_NUM_TX_XSTATS; i++) { NIX_XSTATS_NAME_PRINT(xstats_names, count, nix_tx_xstats, i= ); count++; } --=20 You are receiving this mail because: You are the assignee for the bug.= --17586363450.dCd354E.486142 Date: Tue, 23 Sep 2025 16:05:45 +0200 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All
Bug ID 1791
Summary cnxk driver reference past requested xstat array
Product DPDK
Version 25.07
Hardware All
OS All
Status UNCONFIRMED
Severity normal
Priority Normal
Component ethdev
Assignee dev@dpdk.org
Reporter stephen@networkplumber.org
Target Milestone --- 

Because the cnxk driver ignores th=
e limit arguement in some functions such as
xstat_names_get(). If the application asks for only some of the values in t=
he
xstats then an out of bounds reference is possible.

Something like:
  struct rte_esth_xstat_name names[20];

  rte_eth_xstat_get_names(port_id, names, 20);

will cause out of bound array reference down here:



int
roc_nix_xstats_names_get(struct roc_nix *roc_nix,
                         struct roc_nix_xstat_name *xstats_names,
                         unsigned int limit)
{
        struct nix *nix =3D roc_nix_to_nix_priv(roc_nix);
        struct idev_cfg *idev =3D idev_get_cfg();
        uint64_t i, count =3D 0;

        PLT_SET_USED(limit);

        for (i =3D 0; i < CNXK_NIX_NUM_TX_XSTATS; i++) {
                NIX_XSTATS_NAME_PRINT(xstats_names, count, nix_tx_xstats, i=
);
                count++;
        }

You are receiving this mail because:
  • You are the assignee for the bug.
=20=20=20=20=20=20=20=20=20=20
= --17586363450.dCd354E.486142--