* [dpdk-stable] [PATCH] net/thunderx: fix access an array out of bounds
@ 2017-04-07 14:38 marcin.wilk
2017-04-11 10:00 ` Jerin Jacob
2017-04-11 12:35 ` [dpdk-stable] [PATCH v2] " marcin.wilk
0 siblings, 2 replies; 4+ messages in thread
From: marcin.wilk @ 2017-04-07 14:38 UTC (permalink / raw)
To: jerin.jacob, maciej.czekaj; +Cc: dev, stable, Marcin Wilk
From: Marcin Wilk <marcin.wilk@caviumnetworks.com>
Trying to assign more queues to stats struct break only from one loop
when the maximum size is reached. Outside loop interation is continued.
This leads to access an array out of bounds.
Fixes: 21e3fb0050b9 ("net/thunderx: add final bits for secondary queue support")
Signed-off-by: Marcin Wilk <marcin.wilk@caviumnetworks.com>
---
drivers/net/thunderx/nicvf_ethdev.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/net/thunderx/nicvf_ethdev.c b/drivers/net/thunderx/nicvf_ethdev.c
index 6c3670a..40d6671 100644
--- a/drivers/net/thunderx/nicvf_ethdev.c
+++ b/drivers/net/thunderx/nicvf_ethdev.c
@@ -251,6 +251,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
uint16_t rx_start, rx_end;
uint16_t tx_start, tx_end;
size_t i;
+ bool breakout = false;
/* RX queue indices for the first VF */
nicvf_rx_range(dev, nic, &rx_start, &rx_end);
@@ -289,8 +290,10 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
/* Reading per RX ring stats */
for (qidx = rx_start; qidx <= rx_end; qidx++) {
- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS)
+ if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS) {
+ breakout = true;
break;
+ }
nicvf_hw_get_rx_qstats(snic, &rx_qstats,
qidx % MAX_RCV_QUEUES_PER_QS);
@@ -302,14 +305,18 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
nicvf_tx_range(dev, snic, &tx_start, &tx_end);
/* Reading per TX ring stats */
for (qidx = tx_start; qidx <= tx_end; qidx++) {
- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS)
+ if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS) {
+ breakout = true;
break;
+ }
nicvf_hw_get_tx_qstats(snic, &tx_qstats,
qidx % MAX_SND_QUEUES_PER_QS);
stats->q_obytes[qidx] = tx_qstats.q_tx_bytes;
stats->q_opackets[qidx] = tx_qstats.q_tx_packets;
}
+ if (breakout)
+ break;
}
nicvf_hw_get_stats(nic, &port_stats);
--
2.7.4
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [dpdk-stable] [PATCH] net/thunderx: fix access an array out of bounds
2017-04-07 14:38 [dpdk-stable] [PATCH] net/thunderx: fix access an array out of bounds marcin.wilk
@ 2017-04-11 10:00 ` Jerin Jacob
2017-04-11 12:35 ` [dpdk-stable] [PATCH v2] " marcin.wilk
1 sibling, 0 replies; 4+ messages in thread
From: Jerin Jacob @ 2017-04-11 10:00 UTC (permalink / raw)
To: marcin.wilk; +Cc: maciej.czekaj, dev, stable
-----Original Message-----
> Date: Fri, 7 Apr 2017 16:38:41 +0200
> From: marcin.wilk@caviumnetworks.com
> To: jerin.jacob@caviumnetworks.com, maciej.czekaj@caviumnetworks.com
> Cc: dev@dpdk.org, stable@dpdk.org, Marcin Wilk
> <marcin.wilk@caviumnetworks.com>
> Subject: [PATCH] net/thunderx: fix access an array out of bounds
> X-Mailer: git-send-email 2.7.4
>
> From: Marcin Wilk <marcin.wilk@caviumnetworks.com>
>
> Trying to assign more queues to stats struct break only from one loop
> when the maximum size is reached. Outside loop interation is continued.
> This leads to access an array out of bounds.
>
> Fixes: 21e3fb0050b9 ("net/thunderx: add final bits for secondary queue support")
>
> Signed-off-by: Marcin Wilk <marcin.wilk@caviumnetworks.com>
> ---
> drivers/net/thunderx/nicvf_ethdev.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/thunderx/nicvf_ethdev.c b/drivers/net/thunderx/nicvf_ethdev.c
> index 6c3670a..40d6671 100644
> --- a/drivers/net/thunderx/nicvf_ethdev.c
> +++ b/drivers/net/thunderx/nicvf_ethdev.c
> @@ -251,6 +251,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
> uint16_t rx_start, rx_end;
> uint16_t tx_start, tx_end;
> size_t i;
> + bool breakout = false;
>
> /* RX queue indices for the first VF */
> nicvf_rx_range(dev, nic, &rx_start, &rx_end);
> @@ -289,8 +290,10 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
>
> /* Reading per RX ring stats */
> for (qidx = rx_start; qidx <= rx_end; qidx++) {
> - if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS)
IMO, adding the qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS is much simpler than
breakout logic.
With that change:
Acked-by: Jerin Jacob <jerin.jacob@caviumnetworks.com>
> + if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS) {
> + breakout = true;
> break;
> + }
>
> nicvf_hw_get_rx_qstats(snic, &rx_qstats,
> qidx % MAX_RCV_QUEUES_PER_QS);
> @@ -302,14 +305,18 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
> nicvf_tx_range(dev, snic, &tx_start, &tx_end);
> /* Reading per TX ring stats */
> for (qidx = tx_start; qidx <= tx_end; qidx++) {
> - if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS)
> + if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS) {
> + breakout = true;
> break;
> + }
>
> nicvf_hw_get_tx_qstats(snic, &tx_qstats,
> qidx % MAX_SND_QUEUES_PER_QS);
> stats->q_obytes[qidx] = tx_qstats.q_tx_bytes;
> stats->q_opackets[qidx] = tx_qstats.q_tx_packets;
> }
> + if (breakout)
> + break;
> }
>
> nicvf_hw_get_stats(nic, &port_stats);
> --
> 2.7.4
>
^ permalink raw reply [flat|nested] 4+ messages in thread* [dpdk-stable] [PATCH v2] net/thunderx: fix access an array out of bounds
2017-04-07 14:38 [dpdk-stable] [PATCH] net/thunderx: fix access an array out of bounds marcin.wilk
2017-04-11 10:00 ` Jerin Jacob
@ 2017-04-11 12:35 ` marcin.wilk
2017-04-11 13:15 ` Ferruh Yigit
1 sibling, 1 reply; 4+ messages in thread
From: marcin.wilk @ 2017-04-11 12:35 UTC (permalink / raw)
To: jerin.jacob, maciej.czekaj; +Cc: dev, stable, Marcin Wilk
From: Marcin Wilk <marcin.wilk@caviumnetworks.com>
Trying to assign more queues to stats struct break only from one loop
when the maximum size is reached. Outside loop iteration is continued.
This leads to access an array out of bounds.
Fixes: 21e3fb0050b9 ("net/thunderx: add final bits for secondary queue support")
Signed-off-by: Marcin Wilk <marcin.wilk@caviumnetworks.com>
Acked-by: Jerin Jacob <jerin.jacob@caviumnetworks.com>
---
drivers/net/thunderx/nicvf_ethdev.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/thunderx/nicvf_ethdev.c b/drivers/net/thunderx/nicvf_ethdev.c
index 6c3670a..27fe93c 100644
--- a/drivers/net/thunderx/nicvf_ethdev.c
+++ b/drivers/net/thunderx/nicvf_ethdev.c
@@ -257,7 +257,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
/* Reading per RX ring stats */
for (qidx = rx_start; qidx <= rx_end; qidx++) {
- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS)
+ if (qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS)
break;
nicvf_hw_get_rx_qstats(nic, &rx_qstats, qidx);
@@ -270,7 +270,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
/* Reading per TX ring stats */
for (qidx = tx_start; qidx <= tx_end; qidx++) {
- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS)
+ if (qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS)
break;
nicvf_hw_get_tx_qstats(nic, &tx_qstats, qidx);
@@ -289,7 +289,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
/* Reading per RX ring stats */
for (qidx = rx_start; qidx <= rx_end; qidx++) {
- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS)
+ if (qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS)
break;
nicvf_hw_get_rx_qstats(snic, &rx_qstats,
@@ -302,7 +302,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats)
nicvf_tx_range(dev, snic, &tx_start, &tx_end);
/* Reading per TX ring stats */
for (qidx = tx_start; qidx <= tx_end; qidx++) {
- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS)
+ if (qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS)
break;
nicvf_hw_get_tx_qstats(snic, &tx_qstats,
--
2.7.4
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [dpdk-stable] [PATCH v2] net/thunderx: fix access an array out of bounds
2017-04-11 12:35 ` [dpdk-stable] [PATCH v2] " marcin.wilk
@ 2017-04-11 13:15 ` Ferruh Yigit
0 siblings, 0 replies; 4+ messages in thread
From: Ferruh Yigit @ 2017-04-11 13:15 UTC (permalink / raw)
To: marcin.wilk, jerin.jacob, maciej.czekaj; +Cc: dev, stable
On 4/11/2017 1:35 PM, marcin.wilk@caviumnetworks.com wrote:
> From: Marcin Wilk <marcin.wilk@caviumnetworks.com>
>
> Trying to assign more queues to stats struct break only from one loop
> when the maximum size is reached. Outside loop iteration is continued.
> This leads to access an array out of bounds.
>
> Fixes: 21e3fb0050b9 ("net/thunderx: add final bits for secondary queue support")
>
> Signed-off-by: Marcin Wilk <marcin.wilk@caviumnetworks.com>
> Acked-by: Jerin Jacob <jerin.jacob@caviumnetworks.com>
Applied to dpdk-next-net/master, thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-04-11 13:15 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-04-07 14:38 [dpdk-stable] [PATCH] net/thunderx: fix access an array out of bounds marcin.wilk
2017-04-11 10:00 ` Jerin Jacob
2017-04-11 12:35 ` [dpdk-stable] [PATCH v2] " marcin.wilk
2017-04-11 13:15 ` Ferruh Yigit
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).