From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id D5D65A00C2 for ; Wed, 17 Mar 2021 09:21:32 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id C7DC6242B9E; Wed, 17 Mar 2021 09:21:31 +0100 (CET) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mails.dpdk.org (Postfix) with ESMTP id 40D6F242B8B; Wed, 17 Mar 2021 09:21:30 +0100 (CET) IronPort-SDR: rVX/O3pWNidfLNxoSrwkIwORbGzGEsmmTUFe+sy7SVRk6hcJddPvRCacxf1ISavePFzBBjXdxX DPtdBTjn/5FQ== X-IronPort-AV: E=McAfee;i="6000,8403,9925"; a="274463935" X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="274463935" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Mar 2021 01:21:29 -0700 IronPort-SDR: ROmBbgwCiO1lJLvLzR+rT4aoPd/RAypzR3iF38C25g6ITYETI880ZDKvokqcmzOjc/OMMFxXn6 xPHlNZ3LykuQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="602144384" Received: from unknown (HELO sh_lab5_1.sh.intel.com) ([10.238.175.190]) by fmsmga006.fm.intel.com with ESMTP; 17 Mar 2021 01:21:27 -0700 From: Wei Huang To: dev@dpdk.org, rosen.xu@intel.com, qi.z.zhang@intel.com Cc: stable@dpdk.org, tianfei.zhang@intel.com, Wei Huang Date: Wed, 17 Mar 2021 04:21:35 -0400 Message-Id: <1615969296-17021-4-git-send-email-wei.huang@intel.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1615969296-17021-1-git-send-email-wei.huang@intel.com> References: <1615969296-17021-1-git-send-email-wei.huang@intel.com> Subject: [dpdk-stable] [PATCH v1 3/4] raw/ifpga/base: assign unsigned value to length X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" In fpga_update_flash(), "smgr->rsu_length" is passed to a parameter that cannot be negative. So return value of function "lseek" should be checked before being assigned to "smgr->rsu_length". Coverity issue: 367481 Fixes: 7a4f3993f269 ("raw/ifpga: add FPGA RSU APIs") Signed-off-by: Wei Huang --- drivers/raw/ifpga/base/ifpga_fme_rsu.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/raw/ifpga/base/ifpga_fme_rsu.c b/drivers/raw/ifpga/base/ifpga_fme_rsu.c index a4cb2f54ba..79ee37c282 100644 --- a/drivers/raw/ifpga/base/ifpga_fme_rsu.c +++ b/drivers/raw/ifpga/base/ifpga_fme_rsu.c @@ -277,6 +277,7 @@ int fpga_update_flash(struct ifpga_fme_hw *fme, const char *image, struct ifpga_sec_mgr *smgr = NULL; uint32_t rsu_stat = 0; int fd = -1; + off_t len = 0; struct sigaction old_sigint_action; struct sigaction sa; time_t start; @@ -320,9 +321,21 @@ int fpga_update_flash(struct ifpga_fme_hw *fme, const char *image, image, strerror(errno)); return -EIO; } - smgr->rsu_length = lseek(fd, 0, SEEK_END); + len = lseek(fd, 0, SEEK_END); close(fd); + if (len < 0) { + dev_err(smgr, + "Failed to get file length of \'%s\' [e:%s]\n", + image, strerror(errno)); + return -EIO; + } + if (len == 0) { + dev_err(smgr, "Length of file \'%s\' is invalid\n", image); + return -EINVAL; + } + smgr->rsu_length = len; + if (smgr->max10_dev->staging_area_size < smgr->rsu_length) { dev_err(dev, "Size of staging area is small than image length " "[%u<%u]\n", smgr->max10_dev->staging_area_size, -- 2.29.2