* [PATCH 1/8] net/nfp: fix return value check
[not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
@ 2024-03-14 7:05 ` Chaoyong He
2024-03-14 7:05 ` [PATCH 2/8] net/nfp: fix string overflow Chaoyong He
` (7 subsequent siblings)
8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:05 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang
CI found calling 'rte_eth_switch_domain_free()' without checking return
value.
Coverity issue: 414936
Fixes: 20eaa8e2ebae ("net/nfp: free switch domain ID on close")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/flower/nfp_flower.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/flower/nfp_flower.c b/drivers/net/nfp/flower/nfp_flower.c
index 97219ff379..303f6bd3f6 100644
--- a/drivers/net/nfp/flower/nfp_flower.c
+++ b/drivers/net/nfp/flower/nfp_flower.c
@@ -793,7 +793,8 @@ nfp_uninit_app_fw_flower(struct nfp_pf_dev *pf_dev)
rte_free(app_fw_flower->pf_hw);
nfp_mtr_priv_uninit(pf_dev);
nfp_flow_priv_uninit(pf_dev);
- rte_eth_switch_domain_free(app_fw_flower->switch_domain_id);
+ if (rte_eth_switch_domain_free(app_fw_flower->switch_domain_id) != 0)
+ PMD_DRV_LOG(WARNING, "Failed to free switch domain for device");
rte_free(app_fw_flower);
}
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH 2/8] net/nfp: fix string overflow
[not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
2024-03-14 7:05 ` [PATCH 1/8] net/nfp: fix return value check Chaoyong He
@ 2024-03-14 7:05 ` Chaoyong He
2024-03-14 7:05 ` [PATCH 3/8] net/nfp: fix unreachable control flow Chaoyong He
` (6 subsequent siblings)
8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:05 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang
CI found in the logic of 'nfp_sync_pci_inner_handle_alloc()', use
'strcpy()' may cause string overflow, fix it by use 'rte_strlcpy()'.
Coverity issue: 414937
Fixes: 6b4273a03779 ("net/nfp: add synchronization module")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfpcore/nfp_sync.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/nfpcore/nfp_sync.c b/drivers/net/nfp/nfpcore/nfp_sync.c
index 8bc38d6585..686cdf8eb1 100644
--- a/drivers/net/nfp/nfpcore/nfp_sync.c
+++ b/drivers/net/nfp/nfpcore/nfp_sync.c
@@ -9,6 +9,7 @@
#include <rte_malloc.h>
#include <rte_memzone.h>
#include <rte_spinlock.h>
+#include <rte_string_fns.h>
#include "nfp_logs.h"
@@ -266,7 +267,7 @@ nfp_sync_pci_inner_handle_alloc(struct nfp_sync *sync,
for (i = 0; i < NFP_SYNC_PCI_MAX; i++) {
if (strlen(sync->pci[i].pci_name) == 0) {
pci_avail_id = i;
- strcpy(sync->pci[pci_avail_id].pci_name, pci_name);
+ rte_strlcpy(sync->pci[pci_avail_id].pci_name, pci_name, PCI_PRI_STR_SIZE);
goto common_alloc;
}
}
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH 3/8] net/nfp: fix unreachable control flow
[not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
2024-03-14 7:05 ` [PATCH 1/8] net/nfp: fix return value check Chaoyong He
2024-03-14 7:05 ` [PATCH 2/8] net/nfp: fix string overflow Chaoyong He
@ 2024-03-14 7:05 ` Chaoyong He
2024-03-14 7:05 ` [PATCH 4/8] net/nfp: fix check return value Chaoyong He
` (5 subsequent siblings)
8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:05 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang
CI found there has unreachable control flow, fix it by remove the
missing delete 'return' statement.
Coverity issue: 414938
Fixes: 369945667251 ("net/nfp: fix resource leak for device initialization")
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfp_ethdev.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/nfp/nfp_ethdev.c b/drivers/net/nfp/nfp_ethdev.c
index 31c54a595c..568de1d024 100644
--- a/drivers/net/nfp/nfp_ethdev.c
+++ b/drivers/net/nfp/nfp_ethdev.c
@@ -936,7 +936,6 @@ nfp_net_init(struct rte_eth_dev *eth_dev)
err = nfp_net_tlv_caps_parse(eth_dev);
if (err != 0) {
PMD_INIT_LOG(ERR, "Failed to parser TLV caps");
- return err;
goto free_area;
}
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH 4/8] net/nfp: fix check return value
[not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
` (2 preceding siblings ...)
2024-03-14 7:05 ` [PATCH 3/8] net/nfp: fix unreachable control flow Chaoyong He
@ 2024-03-14 7:05 ` Chaoyong He
2024-03-14 7:05 ` [PATCH 5/8] net/nfp: fix unreachable loop flow Chaoyong He
` (4 subsequent siblings)
8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:05 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang
CI found in 'nfp_service_disable()', not check the return value of API
'rte_service_map_lcore_set()'.
Coverity issue: 414939
Fixes: 600f6d2c7704 ("net/nfp: add service module")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfp_service.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/nfp_service.c b/drivers/net/nfp/nfp_service.c
index f49fa6addf..24d60857ac 100644
--- a/drivers/net/nfp/nfp_service.c
+++ b/drivers/net/nfp/nfp_service.c
@@ -90,6 +90,7 @@ nfp_service_enable(const struct rte_service_spec *service_spec,
int
nfp_service_disable(struct nfp_service_info *info)
{
+ int ret;
uint32_t i;
const char *service_name;
@@ -107,10 +108,16 @@ nfp_service_disable(struct nfp_service_info *info)
break;
rte_delay_ms(1);
}
+
if (i == NFP_SERVICE_DISABLE_WAIT_COUNT)
PMD_DRV_LOG(ERR, "Could not stop service %s", service_name);
- rte_service_map_lcore_set(info->id, info->lcore, 0);
+ ret = rte_service_map_lcore_set(info->id, info->lcore, 0);
+ if (ret != 0) {
+ PMD_DRV_LOG(DEBUG, "Could not unmap flower service");
+ return -ENOENT;
+ }
+
rte_service_component_unregister(info->id);
return 0;
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH 5/8] net/nfp: fix unreachable loop flow
[not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
` (3 preceding siblings ...)
2024-03-14 7:05 ` [PATCH 4/8] net/nfp: fix check return value Chaoyong He
@ 2024-03-14 7:05 ` Chaoyong He
2024-03-14 7:05 ` [PATCH 6/8] net/nfp: fix null pointer dereference Chaoyong He
` (3 subsequent siblings)
8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:05 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang
CI found the loop flow in 'nfp_net_flow_calculate_items()' will never
execute more than once.
Coverity issue: 414941
Fixes: c91c6512d876 ("net/nfp: support Ethernet flow item")
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfp_net_flow.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index ff6ce3ee45..251974edb4 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -180,6 +180,7 @@ static int
nfp_net_flow_calculate_items(const struct rte_flow_item items[],
uint32_t *match_len)
{
+ int ret = -EINVAL;
const struct rte_flow_item *item;
for (item = items; item->type != RTE_FLOW_ITEM_TYPE_END; ++item) {
@@ -187,7 +188,8 @@ nfp_net_flow_calculate_items(const struct rte_flow_item items[],
case RTE_FLOW_ITEM_TYPE_ETH:
PMD_DRV_LOG(DEBUG, "RTE_FLOW_ITEM_TYPE_ETH detected");
*match_len = sizeof(struct nfp_net_cmsg_match_eth);
- return 0;
+ ret = 0;
+ break;
case RTE_FLOW_ITEM_TYPE_IPV4:
PMD_DRV_LOG(DEBUG, "RTE_FLOW_ITEM_TYPE_IPV4 detected");
*match_len = sizeof(struct nfp_net_cmsg_match_v4);
@@ -203,7 +205,7 @@ nfp_net_flow_calculate_items(const struct rte_flow_item items[],
}
}
- return -EINVAL;
+ return ret;
}
static int
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH 6/8] net/nfp: fix null pointer dereference
[not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
` (4 preceding siblings ...)
2024-03-14 7:05 ` [PATCH 5/8] net/nfp: fix unreachable loop flow Chaoyong He
@ 2024-03-14 7:05 ` Chaoyong He
2024-03-14 7:05 ` [PATCH 7/8] net/nfp: fix dereference after null check Chaoyong He
` (2 subsequent siblings)
8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:05 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang
CI found there are null pointer dereference in 'nfp_flow_merge_l4()'.
Coverity issue: 414942
Fixes: 94438b093702 ("net/nfp: support TCP/UDP/SCTP flow items")
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfp_net_flow.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index 251974edb4..ea743eed73 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -349,12 +349,15 @@ nfp_flow_merge_l4(struct rte_flow *nfp_flow,
ipv4->src_port = rte_be_to_cpu_16(spec->hdr.src_port);
ipv4->dst_port = rte_be_to_cpu_16(spec->hdr.dst_port);
- } else {
+ } else if (ipv6 != NULL) {
ipv6->src_port_mask = rte_be_to_cpu_16(mask->hdr.src_port);
ipv6->dst_port_mask = rte_be_to_cpu_16(mask->hdr.dst_port);
ipv6->src_port = rte_be_to_cpu_16(spec->hdr.src_port);
ipv6->dst_port = rte_be_to_cpu_16(spec->hdr.dst_port);
+ } else {
+ PMD_DRV_LOG(ERR, "No valid L3 layer pointer.");
+ return -EINVAL;
}
return 0;
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH 7/8] net/nfp: fix dereference after null check
[not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
` (5 preceding siblings ...)
2024-03-14 7:05 ` [PATCH 6/8] net/nfp: fix null pointer dereference Chaoyong He
@ 2024-03-14 7:05 ` Chaoyong He
2024-03-14 7:05 ` [PATCH 8/8] net/nfp: fix tainted scalar Chaoyong He
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:05 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Peng Zhang, stable, Chaoyong He
From: Peng Zhang <peng.zhang@corigine.com>
CI found in the logic of 'nfp_elf_read_first_symtab()' has
dereference after null check problem.
Coverity issue: 415042
Fixes: c82ca09c441c ("net/nfp: add ELF module")
Cc: stable@dpdk.org
Signed-off-by: Peng Zhang <peng.zhang@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
drivers/net/nfp/nfpcore/nfp_elf.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/nfpcore/nfp_elf.c b/drivers/net/nfp/nfpcore/nfp_elf.c
index fbd350589b..268cdb1aff 100644
--- a/drivers/net/nfp/nfpcore/nfp_elf.c
+++ b/drivers/net/nfp/nfpcore/nfp_elf.c
@@ -900,7 +900,8 @@ nfp_elf_read_first_symtab(struct nfp_elf *ectx)
uint64_t sh_size;
struct nfp_elf_elf64_shdr *sec;
- for (idx = 0, sec = ectx->shdrs; idx < ectx->shdrs_cnt; idx++, sec++) {
+ for (idx = 0; idx < ectx->shdrs_cnt; idx++) {
+ sec = &ectx->shdrs[idx];
if (sec != NULL) {
sh_type = rte_le_to_cpu_32(sec->sh_type);
if (sh_type == NFP_ELF_SHT_SYMTAB)
@@ -908,6 +909,9 @@ nfp_elf_read_first_symtab(struct nfp_elf *ectx)
}
}
+ if (sec == NULL)
+ return -EINVAL;
+
sh_size = rte_le_to_cpu_64(sec->sh_size);
if (idx < ectx->shdrs_cnt && sh_type == NFP_ELF_SHT_SYMTAB) {
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH 8/8] net/nfp: fix tainted scalar
[not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
` (6 preceding siblings ...)
2024-03-14 7:05 ` [PATCH 7/8] net/nfp: fix dereference after null check Chaoyong He
@ 2024-03-14 7:05 ` Chaoyong He
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:05 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Peng Zhang, stable, Chaoyong He
From: Peng Zhang <peng.zhang@corigine.com>
Passing tainted expression 'ectx->fw_info_strtab_sz' to
'nfp_elf_fwinfo_lookup()', which uses it as a loop boundary.
Replace tainted expression with a temp variable to avoid
the tainted scalar coverity warning.
Coverity issue: 415051
Fixes: c82ca09c441c ("net/nfp: add ELF module")
Cc: stable@dpdk.org
Signed-off-by: Peng Zhang <peng.zhang@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
drivers/net/nfp/nfpcore/nfp_elf.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/net/nfp/nfpcore/nfp_elf.c b/drivers/net/nfp/nfpcore/nfp_elf.c
index 268cdb1aff..fab9b68801 100644
--- a/drivers/net/nfp/nfpcore/nfp_elf.c
+++ b/drivers/net/nfp/nfpcore/nfp_elf.c
@@ -324,14 +324,13 @@ nfp_elf_fwinfo_next(struct nfp_elf *ectx,
}
static const char *
-nfp_elf_fwinfo_lookup(struct nfp_elf *ectx,
+nfp_elf_fwinfo_lookup(const char *strtab,
+ ssize_t tab_sz,
const char *key)
{
size_t s_len;
const char *s;
size_t key_len = strlen(key);
- const char *strtab = ectx->fw_info_strtab;
- ssize_t tab_sz = (ssize_t)ectx->fw_info_strtab_sz;
if (strtab == NULL)
return NULL;
@@ -610,7 +609,9 @@ nfp_elf_populate_fw_mip(struct nfp_elf *ectx,
{
uint8_t *pu8;
const char *nx;
+ ssize_t tab_sz;
uint64_t sh_size;
+ const char *str_tab;
uint64_t sh_offset;
uint32_t first_entry;
const struct nfp_mip *mip;
@@ -662,7 +663,9 @@ nfp_elf_populate_fw_mip(struct nfp_elf *ectx,
}
}
- ectx->fw_mip.fw_typeid = nfp_elf_fwinfo_lookup(ectx, "TypeId");
+ str_tab = ectx->fw_info_strtab;
+ tab_sz = (ssize_t)ectx->fw_info_strtab_sz;
+ ectx->fw_mip.fw_typeid = nfp_elf_fwinfo_lookup(str_tab, tab_sz, "TypeId");
/*
* TypeId will be the last reserved key-value pair, so skip
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread[parent not found: <20240314074024.3199555-1-chaoyong.he@corigine.com>]
* [PATCH v2 1/8] net/nfp: fix return value check
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
@ 2024-03-14 7:40 ` Chaoyong He
2024-03-14 7:40 ` [PATCH v2 2/8] net/nfp: fix string overflow Chaoyong He
` (6 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:40 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang
CI found calling 'rte_eth_switch_domain_free()' without checking return
value.
Coverity issue: 414936
Fixes: 20eaa8e2ebae ("net/nfp: free switch domain ID on close")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/flower/nfp_flower.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/flower/nfp_flower.c b/drivers/net/nfp/flower/nfp_flower.c
index 97219ff379..303f6bd3f6 100644
--- a/drivers/net/nfp/flower/nfp_flower.c
+++ b/drivers/net/nfp/flower/nfp_flower.c
@@ -793,7 +793,8 @@ nfp_uninit_app_fw_flower(struct nfp_pf_dev *pf_dev)
rte_free(app_fw_flower->pf_hw);
nfp_mtr_priv_uninit(pf_dev);
nfp_flow_priv_uninit(pf_dev);
- rte_eth_switch_domain_free(app_fw_flower->switch_domain_id);
+ if (rte_eth_switch_domain_free(app_fw_flower->switch_domain_id) != 0)
+ PMD_DRV_LOG(WARNING, "Failed to free switch domain for device");
rte_free(app_fw_flower);
}
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH v2 2/8] net/nfp: fix string overflow
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
2024-03-14 7:40 ` [PATCH v2 1/8] net/nfp: fix return value check Chaoyong He
@ 2024-03-14 7:40 ` Chaoyong He
2024-03-14 7:40 ` [PATCH v2 3/8] net/nfp: fix unreachable control flow Chaoyong He
` (5 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:40 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang
CI found in the logic of 'nfp_sync_pci_inner_handle_alloc()', use
'strcpy()' may cause string overflow, fix it by use 'rte_strlcpy()'.
Coverity issue: 414937
Fixes: 6b4273a03779 ("net/nfp: add synchronization module")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfpcore/nfp_sync.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/nfpcore/nfp_sync.c b/drivers/net/nfp/nfpcore/nfp_sync.c
index 8bc38d6585..686cdf8eb1 100644
--- a/drivers/net/nfp/nfpcore/nfp_sync.c
+++ b/drivers/net/nfp/nfpcore/nfp_sync.c
@@ -9,6 +9,7 @@
#include <rte_malloc.h>
#include <rte_memzone.h>
#include <rte_spinlock.h>
+#include <rte_string_fns.h>
#include "nfp_logs.h"
@@ -266,7 +267,7 @@ nfp_sync_pci_inner_handle_alloc(struct nfp_sync *sync,
for (i = 0; i < NFP_SYNC_PCI_MAX; i++) {
if (strlen(sync->pci[i].pci_name) == 0) {
pci_avail_id = i;
- strcpy(sync->pci[pci_avail_id].pci_name, pci_name);
+ rte_strlcpy(sync->pci[pci_avail_id].pci_name, pci_name, PCI_PRI_STR_SIZE);
goto common_alloc;
}
}
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH v2 3/8] net/nfp: fix unreachable control flow
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
2024-03-14 7:40 ` [PATCH v2 1/8] net/nfp: fix return value check Chaoyong He
2024-03-14 7:40 ` [PATCH v2 2/8] net/nfp: fix string overflow Chaoyong He
@ 2024-03-14 7:40 ` Chaoyong He
2024-03-14 7:40 ` [PATCH v2 4/8] net/nfp: fix check return value Chaoyong He
` (4 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:40 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang
CI found there has unreachable control flow, fix it by remove the
missing delete 'return' statement.
Coverity issue: 414938
Fixes: 369945667251 ("net/nfp: fix resource leak for device initialization")
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfp_ethdev.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/nfp/nfp_ethdev.c b/drivers/net/nfp/nfp_ethdev.c
index 31c54a595c..568de1d024 100644
--- a/drivers/net/nfp/nfp_ethdev.c
+++ b/drivers/net/nfp/nfp_ethdev.c
@@ -936,7 +936,6 @@ nfp_net_init(struct rte_eth_dev *eth_dev)
err = nfp_net_tlv_caps_parse(eth_dev);
if (err != 0) {
PMD_INIT_LOG(ERR, "Failed to parser TLV caps");
- return err;
goto free_area;
}
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH v2 4/8] net/nfp: fix check return value
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
` (2 preceding siblings ...)
2024-03-14 7:40 ` [PATCH v2 3/8] net/nfp: fix unreachable control flow Chaoyong He
@ 2024-03-14 7:40 ` Chaoyong He
2024-03-14 7:40 ` [PATCH v2 5/8] net/nfp: fix unreachable loop flow Chaoyong He
` (3 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:40 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang
CI found in 'nfp_service_disable()', not check the return value of API
'rte_service_map_lcore_set()'.
Coverity issue: 414939
Fixes: 600f6d2c7704 ("net/nfp: add service module")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfp_service.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/nfp_service.c b/drivers/net/nfp/nfp_service.c
index f49fa6addf..24d60857ac 100644
--- a/drivers/net/nfp/nfp_service.c
+++ b/drivers/net/nfp/nfp_service.c
@@ -90,6 +90,7 @@ nfp_service_enable(const struct rte_service_spec *service_spec,
int
nfp_service_disable(struct nfp_service_info *info)
{
+ int ret;
uint32_t i;
const char *service_name;
@@ -107,10 +108,16 @@ nfp_service_disable(struct nfp_service_info *info)
break;
rte_delay_ms(1);
}
+
if (i == NFP_SERVICE_DISABLE_WAIT_COUNT)
PMD_DRV_LOG(ERR, "Could not stop service %s", service_name);
- rte_service_map_lcore_set(info->id, info->lcore, 0);
+ ret = rte_service_map_lcore_set(info->id, info->lcore, 0);
+ if (ret != 0) {
+ PMD_DRV_LOG(DEBUG, "Could not unmap flower service");
+ return -ENOENT;
+ }
+
rte_service_component_unregister(info->id);
return 0;
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH v2 5/8] net/nfp: fix unreachable loop flow
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
` (3 preceding siblings ...)
2024-03-14 7:40 ` [PATCH v2 4/8] net/nfp: fix check return value Chaoyong He
@ 2024-03-14 7:40 ` Chaoyong He
2024-03-14 7:40 ` [PATCH v2 6/8] net/nfp: fix null pointer dereference Chaoyong He
` (2 subsequent siblings)
7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:40 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang
CI found the loop flow in 'nfp_net_flow_calculate_items()' will never
execute more than once.
Coverity issue: 414941
Fixes: c91c6512d876 ("net/nfp: support Ethernet flow item")
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfp_net_flow.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index ff6ce3ee45..251974edb4 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -180,6 +180,7 @@ static int
nfp_net_flow_calculate_items(const struct rte_flow_item items[],
uint32_t *match_len)
{
+ int ret = -EINVAL;
const struct rte_flow_item *item;
for (item = items; item->type != RTE_FLOW_ITEM_TYPE_END; ++item) {
@@ -187,7 +188,8 @@ nfp_net_flow_calculate_items(const struct rte_flow_item items[],
case RTE_FLOW_ITEM_TYPE_ETH:
PMD_DRV_LOG(DEBUG, "RTE_FLOW_ITEM_TYPE_ETH detected");
*match_len = sizeof(struct nfp_net_cmsg_match_eth);
- return 0;
+ ret = 0;
+ break;
case RTE_FLOW_ITEM_TYPE_IPV4:
PMD_DRV_LOG(DEBUG, "RTE_FLOW_ITEM_TYPE_IPV4 detected");
*match_len = sizeof(struct nfp_net_cmsg_match_v4);
@@ -203,7 +205,7 @@ nfp_net_flow_calculate_items(const struct rte_flow_item items[],
}
}
- return -EINVAL;
+ return ret;
}
static int
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH v2 6/8] net/nfp: fix null pointer dereference
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
` (4 preceding siblings ...)
2024-03-14 7:40 ` [PATCH v2 5/8] net/nfp: fix unreachable loop flow Chaoyong He
@ 2024-03-14 7:40 ` Chaoyong He
2024-03-14 7:40 ` [PATCH v2 7/8] net/nfp: fix dereference after null check Chaoyong He
2024-03-14 7:40 ` [PATCH v2 8/8] net/nfp: fix tainted scalar Chaoyong He
7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:40 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang
CI found there are null pointer dereference in 'nfp_flow_merge_l4()'.
Coverity issue: 414942
Fixes: 94438b093702 ("net/nfp: support TCP/UDP/SCTP flow items")
Cc: stable@dpdk.org
Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
drivers/net/nfp/nfp_net_flow.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index 251974edb4..ea743eed73 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -349,12 +349,15 @@ nfp_flow_merge_l4(struct rte_flow *nfp_flow,
ipv4->src_port = rte_be_to_cpu_16(spec->hdr.src_port);
ipv4->dst_port = rte_be_to_cpu_16(spec->hdr.dst_port);
- } else {
+ } else if (ipv6 != NULL) {
ipv6->src_port_mask = rte_be_to_cpu_16(mask->hdr.src_port);
ipv6->dst_port_mask = rte_be_to_cpu_16(mask->hdr.dst_port);
ipv6->src_port = rte_be_to_cpu_16(spec->hdr.src_port);
ipv6->dst_port = rte_be_to_cpu_16(spec->hdr.dst_port);
+ } else {
+ PMD_DRV_LOG(ERR, "No valid L3 layer pointer.");
+ return -EINVAL;
}
return 0;
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH v2 7/8] net/nfp: fix dereference after null check
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
` (5 preceding siblings ...)
2024-03-14 7:40 ` [PATCH v2 6/8] net/nfp: fix null pointer dereference Chaoyong He
@ 2024-03-14 7:40 ` Chaoyong He
2024-03-14 7:40 ` [PATCH v2 8/8] net/nfp: fix tainted scalar Chaoyong He
7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:40 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Peng Zhang, stable, Chaoyong He
From: Peng Zhang <peng.zhang@corigine.com>
CI found in the logic of 'nfp_elf_read_first_symtab()' has
dereference after null check problem.
Coverity issue: 415042
Fixes: c82ca09c441c ("net/nfp: add ELF module")
Cc: stable@dpdk.org
Signed-off-by: Peng Zhang <peng.zhang@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
drivers/net/nfp/nfpcore/nfp_elf.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/nfp/nfpcore/nfp_elf.c b/drivers/net/nfp/nfpcore/nfp_elf.c
index fbd350589b..1bf68ab3e4 100644
--- a/drivers/net/nfp/nfpcore/nfp_elf.c
+++ b/drivers/net/nfp/nfpcore/nfp_elf.c
@@ -898,9 +898,10 @@ nfp_elf_read_first_symtab(struct nfp_elf *ectx)
size_t idx;
uint32_t sh_type;
uint64_t sh_size;
- struct nfp_elf_elf64_shdr *sec;
+ struct nfp_elf_elf64_shdr *sec = NULL;
- for (idx = 0, sec = ectx->shdrs; idx < ectx->shdrs_cnt; idx++, sec++) {
+ for (idx = 0; idx < ectx->shdrs_cnt; idx++) {
+ sec = &ectx->shdrs[idx];
if (sec != NULL) {
sh_type = rte_le_to_cpu_32(sec->sh_type);
if (sh_type == NFP_ELF_SHT_SYMTAB)
@@ -908,6 +909,9 @@ nfp_elf_read_first_symtab(struct nfp_elf *ectx)
}
}
+ if (sec == NULL)
+ return -EINVAL;
+
sh_size = rte_le_to_cpu_64(sec->sh_size);
if (idx < ectx->shdrs_cnt && sh_type == NFP_ELF_SHT_SYMTAB) {
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread* [PATCH v2 8/8] net/nfp: fix tainted scalar
[not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
` (6 preceding siblings ...)
2024-03-14 7:40 ` [PATCH v2 7/8] net/nfp: fix dereference after null check Chaoyong He
@ 2024-03-14 7:40 ` Chaoyong He
7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14 7:40 UTC (permalink / raw)
To: dev; +Cc: oss-drivers, Peng Zhang, stable, Chaoyong He
From: Peng Zhang <peng.zhang@corigine.com>
Passing tainted expression 'ectx->fw_info_strtab_sz' to
'nfp_elf_fwinfo_lookup()', which uses it as a loop boundary.
Replace tainted expression with a temp variable to avoid
the tainted scalar coverity warning.
Coverity issue: 415051
Fixes: c82ca09c441c ("net/nfp: add ELF module")
Cc: stable@dpdk.org
Signed-off-by: Peng Zhang <peng.zhang@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
drivers/net/nfp/nfpcore/nfp_elf.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/drivers/net/nfp/nfpcore/nfp_elf.c b/drivers/net/nfp/nfpcore/nfp_elf.c
index 1bf68ab3e4..cfa59ed16d 100644
--- a/drivers/net/nfp/nfpcore/nfp_elf.c
+++ b/drivers/net/nfp/nfpcore/nfp_elf.c
@@ -324,14 +324,13 @@ nfp_elf_fwinfo_next(struct nfp_elf *ectx,
}
static const char *
-nfp_elf_fwinfo_lookup(struct nfp_elf *ectx,
+nfp_elf_fwinfo_lookup(const char *strtab,
+ ssize_t tab_sz,
const char *key)
{
size_t s_len;
const char *s;
size_t key_len = strlen(key);
- const char *strtab = ectx->fw_info_strtab;
- ssize_t tab_sz = (ssize_t)ectx->fw_info_strtab_sz;
if (strtab == NULL)
return NULL;
@@ -610,7 +609,9 @@ nfp_elf_populate_fw_mip(struct nfp_elf *ectx,
{
uint8_t *pu8;
const char *nx;
+ ssize_t tab_sz;
uint64_t sh_size;
+ const char *str_tab;
uint64_t sh_offset;
uint32_t first_entry;
const struct nfp_mip *mip;
@@ -662,7 +663,9 @@ nfp_elf_populate_fw_mip(struct nfp_elf *ectx,
}
}
- ectx->fw_mip.fw_typeid = nfp_elf_fwinfo_lookup(ectx, "TypeId");
+ str_tab = ectx->fw_info_strtab;
+ tab_sz = (ssize_t)ectx->fw_info_strtab_sz;
+ ectx->fw_mip.fw_typeid = nfp_elf_fwinfo_lookup(str_tab, tab_sz, "TypeId");
/*
* TypeId will be the last reserved key-value pair, so skip
--
2.39.1
^ permalink raw reply [flat|nested] 16+ messages in thread