patches for DPDK stable branches
 help / color / mirror / Atom feed
* [PATCH 1/8] net/nfp: fix return value check
       [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
@ 2024-03-14  7:05 ` Chaoyong He
  2024-03-14  7:05 ` [PATCH 2/8] net/nfp: fix string overflow Chaoyong He
                   ` (7 subsequent siblings)
  8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:05 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang

CI found calling 'rte_eth_switch_domain_free()' without checking return
value.

Coverity issue: 414936
Fixes: 20eaa8e2ebae ("net/nfp: free switch domain ID on close")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/flower/nfp_flower.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/flower/nfp_flower.c b/drivers/net/nfp/flower/nfp_flower.c
index 97219ff379..303f6bd3f6 100644
--- a/drivers/net/nfp/flower/nfp_flower.c
+++ b/drivers/net/nfp/flower/nfp_flower.c
@@ -793,7 +793,8 @@ nfp_uninit_app_fw_flower(struct nfp_pf_dev *pf_dev)
 	rte_free(app_fw_flower->pf_hw);
 	nfp_mtr_priv_uninit(pf_dev);
 	nfp_flow_priv_uninit(pf_dev);
-	rte_eth_switch_domain_free(app_fw_flower->switch_domain_id);
+	if (rte_eth_switch_domain_free(app_fw_flower->switch_domain_id) != 0)
+		PMD_DRV_LOG(WARNING, "Failed to free switch domain for device");
 	rte_free(app_fw_flower);
 }
 
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH 2/8] net/nfp: fix string overflow
       [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
  2024-03-14  7:05 ` [PATCH 1/8] net/nfp: fix return value check Chaoyong He
@ 2024-03-14  7:05 ` Chaoyong He
  2024-03-14  7:05 ` [PATCH 3/8] net/nfp: fix unreachable control flow Chaoyong He
                   ` (6 subsequent siblings)
  8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:05 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang

CI found in the logic of 'nfp_sync_pci_inner_handle_alloc()', use
'strcpy()' may cause string overflow, fix it by use 'rte_strlcpy()'.

Coverity issue: 414937
Fixes: 6b4273a03779 ("net/nfp: add synchronization module")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfpcore/nfp_sync.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/nfpcore/nfp_sync.c b/drivers/net/nfp/nfpcore/nfp_sync.c
index 8bc38d6585..686cdf8eb1 100644
--- a/drivers/net/nfp/nfpcore/nfp_sync.c
+++ b/drivers/net/nfp/nfpcore/nfp_sync.c
@@ -9,6 +9,7 @@
 #include <rte_malloc.h>
 #include <rte_memzone.h>
 #include <rte_spinlock.h>
+#include <rte_string_fns.h>
 
 #include "nfp_logs.h"
 
@@ -266,7 +267,7 @@ nfp_sync_pci_inner_handle_alloc(struct nfp_sync *sync,
 	for (i = 0; i < NFP_SYNC_PCI_MAX; i++) {
 		if (strlen(sync->pci[i].pci_name) == 0) {
 			pci_avail_id = i;
-			strcpy(sync->pci[pci_avail_id].pci_name, pci_name);
+			rte_strlcpy(sync->pci[pci_avail_id].pci_name, pci_name, PCI_PRI_STR_SIZE);
 			goto common_alloc;
 		}
 	}
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH 3/8] net/nfp: fix unreachable control flow
       [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
  2024-03-14  7:05 ` [PATCH 1/8] net/nfp: fix return value check Chaoyong He
  2024-03-14  7:05 ` [PATCH 2/8] net/nfp: fix string overflow Chaoyong He
@ 2024-03-14  7:05 ` Chaoyong He
  2024-03-14  7:05 ` [PATCH 4/8] net/nfp: fix check return value Chaoyong He
                   ` (5 subsequent siblings)
  8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:05 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang

CI found there has unreachable control flow, fix it by remove the
missing delete 'return' statement.

Coverity issue: 414938
Fixes: 369945667251 ("net/nfp: fix resource leak for device initialization")
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfp_ethdev.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/nfp/nfp_ethdev.c b/drivers/net/nfp/nfp_ethdev.c
index 31c54a595c..568de1d024 100644
--- a/drivers/net/nfp/nfp_ethdev.c
+++ b/drivers/net/nfp/nfp_ethdev.c
@@ -936,7 +936,6 @@ nfp_net_init(struct rte_eth_dev *eth_dev)
 	err = nfp_net_tlv_caps_parse(eth_dev);
 	if (err != 0) {
 		PMD_INIT_LOG(ERR, "Failed to parser TLV caps");
-		return err;
 		goto free_area;
 	}
 
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH 4/8] net/nfp: fix check return value
       [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
                   ` (2 preceding siblings ...)
  2024-03-14  7:05 ` [PATCH 3/8] net/nfp: fix unreachable control flow Chaoyong He
@ 2024-03-14  7:05 ` Chaoyong He
  2024-03-14  7:05 ` [PATCH 5/8] net/nfp: fix unreachable loop flow Chaoyong He
                   ` (4 subsequent siblings)
  8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:05 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang

CI found in 'nfp_service_disable()', not check the return value of API
'rte_service_map_lcore_set()'.

Coverity issue: 414939
Fixes: 600f6d2c7704 ("net/nfp: add service module")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfp_service.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/nfp_service.c b/drivers/net/nfp/nfp_service.c
index f49fa6addf..24d60857ac 100644
--- a/drivers/net/nfp/nfp_service.c
+++ b/drivers/net/nfp/nfp_service.c
@@ -90,6 +90,7 @@ nfp_service_enable(const struct rte_service_spec *service_spec,
 int
 nfp_service_disable(struct nfp_service_info *info)
 {
+	int ret;
 	uint32_t i;
 	const char *service_name;
 
@@ -107,10 +108,16 @@ nfp_service_disable(struct nfp_service_info *info)
 			break;
 		rte_delay_ms(1);
 	}
+
 	if (i == NFP_SERVICE_DISABLE_WAIT_COUNT)
 		PMD_DRV_LOG(ERR, "Could not stop service %s", service_name);
 
-	rte_service_map_lcore_set(info->id, info->lcore, 0);
+	ret = rte_service_map_lcore_set(info->id, info->lcore, 0);
+	if (ret != 0) {
+		PMD_DRV_LOG(DEBUG, "Could not unmap flower service");
+		return -ENOENT;
+	}
+
 	rte_service_component_unregister(info->id);
 
 	return 0;
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH 5/8] net/nfp: fix unreachable loop flow
       [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
                   ` (3 preceding siblings ...)
  2024-03-14  7:05 ` [PATCH 4/8] net/nfp: fix check return value Chaoyong He
@ 2024-03-14  7:05 ` Chaoyong He
  2024-03-14  7:05 ` [PATCH 6/8] net/nfp: fix null pointer dereference Chaoyong He
                   ` (3 subsequent siblings)
  8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:05 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang

CI found the loop flow in 'nfp_net_flow_calculate_items()' will never
execute more than once.

Coverity issue: 414941
Fixes: c91c6512d876 ("net/nfp: support Ethernet flow item")
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfp_net_flow.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index ff6ce3ee45..251974edb4 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -180,6 +180,7 @@ static int
 nfp_net_flow_calculate_items(const struct rte_flow_item items[],
 		uint32_t *match_len)
 {
+	int ret = -EINVAL;
 	const struct rte_flow_item *item;
 
 	for (item = items; item->type != RTE_FLOW_ITEM_TYPE_END; ++item) {
@@ -187,7 +188,8 @@ nfp_net_flow_calculate_items(const struct rte_flow_item items[],
 		case RTE_FLOW_ITEM_TYPE_ETH:
 			PMD_DRV_LOG(DEBUG, "RTE_FLOW_ITEM_TYPE_ETH detected");
 			*match_len = sizeof(struct nfp_net_cmsg_match_eth);
-			return 0;
+			ret = 0;
+			break;
 		case RTE_FLOW_ITEM_TYPE_IPV4:
 			PMD_DRV_LOG(DEBUG, "RTE_FLOW_ITEM_TYPE_IPV4 detected");
 			*match_len = sizeof(struct nfp_net_cmsg_match_v4);
@@ -203,7 +205,7 @@ nfp_net_flow_calculate_items(const struct rte_flow_item items[],
 		}
 	}
 
-	return -EINVAL;
+	return ret;
 }
 
 static int
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH 6/8] net/nfp: fix null pointer dereference
       [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
                   ` (4 preceding siblings ...)
  2024-03-14  7:05 ` [PATCH 5/8] net/nfp: fix unreachable loop flow Chaoyong He
@ 2024-03-14  7:05 ` Chaoyong He
  2024-03-14  7:05 ` [PATCH 7/8] net/nfp: fix dereference after null check Chaoyong He
                   ` (2 subsequent siblings)
  8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:05 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang

CI found there are null pointer dereference in 'nfp_flow_merge_l4()'.

Coverity issue: 414942
Fixes: 94438b093702 ("net/nfp: support TCP/UDP/SCTP flow items")
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfp_net_flow.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index 251974edb4..ea743eed73 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -349,12 +349,15 @@ nfp_flow_merge_l4(struct rte_flow *nfp_flow,
 
 		ipv4->src_port = rte_be_to_cpu_16(spec->hdr.src_port);
 		ipv4->dst_port = rte_be_to_cpu_16(spec->hdr.dst_port);
-	} else {
+	} else if (ipv6 != NULL) {
 		ipv6->src_port_mask = rte_be_to_cpu_16(mask->hdr.src_port);
 		ipv6->dst_port_mask = rte_be_to_cpu_16(mask->hdr.dst_port);
 
 		ipv6->src_port = rte_be_to_cpu_16(spec->hdr.src_port);
 		ipv6->dst_port = rte_be_to_cpu_16(spec->hdr.dst_port);
+	} else {
+		PMD_DRV_LOG(ERR, "No valid L3 layer pointer.");
+		return -EINVAL;
 	}
 
 	return 0;
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH 7/8] net/nfp: fix dereference after null check
       [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
                   ` (5 preceding siblings ...)
  2024-03-14  7:05 ` [PATCH 6/8] net/nfp: fix null pointer dereference Chaoyong He
@ 2024-03-14  7:05 ` Chaoyong He
  2024-03-14  7:05 ` [PATCH 8/8] net/nfp: fix tainted scalar Chaoyong He
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
  8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:05 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Peng Zhang, stable, Chaoyong He

From: Peng Zhang <peng.zhang@corigine.com>

CI found in the logic of 'nfp_elf_read_first_symtab()' has
dereference after null check problem.

Coverity issue: 415042
Fixes: c82ca09c441c ("net/nfp: add ELF module")
Cc: stable@dpdk.org

Signed-off-by: Peng Zhang <peng.zhang@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
 drivers/net/nfp/nfpcore/nfp_elf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/nfpcore/nfp_elf.c b/drivers/net/nfp/nfpcore/nfp_elf.c
index fbd350589b..268cdb1aff 100644
--- a/drivers/net/nfp/nfpcore/nfp_elf.c
+++ b/drivers/net/nfp/nfpcore/nfp_elf.c
@@ -900,7 +900,8 @@ nfp_elf_read_first_symtab(struct nfp_elf *ectx)
 	uint64_t sh_size;
 	struct nfp_elf_elf64_shdr *sec;
 
-	for (idx = 0, sec = ectx->shdrs; idx < ectx->shdrs_cnt; idx++, sec++) {
+	for (idx = 0; idx < ectx->shdrs_cnt; idx++) {
+		sec = &ectx->shdrs[idx];
 		if (sec != NULL) {
 			sh_type = rte_le_to_cpu_32(sec->sh_type);
 			if (sh_type == NFP_ELF_SHT_SYMTAB)
@@ -908,6 +909,9 @@ nfp_elf_read_first_symtab(struct nfp_elf *ectx)
 		}
 	}
 
+	if (sec == NULL)
+		return -EINVAL;
+
 	sh_size = rte_le_to_cpu_64(sec->sh_size);
 
 	if (idx < ectx->shdrs_cnt && sh_type == NFP_ELF_SHT_SYMTAB) {
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH 8/8] net/nfp: fix tainted scalar
       [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
                   ` (6 preceding siblings ...)
  2024-03-14  7:05 ` [PATCH 7/8] net/nfp: fix dereference after null check Chaoyong He
@ 2024-03-14  7:05 ` Chaoyong He
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
  8 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:05 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Peng Zhang, stable, Chaoyong He

From: Peng Zhang <peng.zhang@corigine.com>

Passing tainted expression 'ectx->fw_info_strtab_sz' to
'nfp_elf_fwinfo_lookup()', which uses it as a loop boundary.

Replace tainted expression with a temp variable to avoid
the tainted scalar coverity warning.

Coverity issue: 415051
Fixes: c82ca09c441c ("net/nfp: add ELF module")
Cc: stable@dpdk.org

Signed-off-by: Peng Zhang <peng.zhang@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
 drivers/net/nfp/nfpcore/nfp_elf.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/net/nfp/nfpcore/nfp_elf.c b/drivers/net/nfp/nfpcore/nfp_elf.c
index 268cdb1aff..fab9b68801 100644
--- a/drivers/net/nfp/nfpcore/nfp_elf.c
+++ b/drivers/net/nfp/nfpcore/nfp_elf.c
@@ -324,14 +324,13 @@ nfp_elf_fwinfo_next(struct nfp_elf *ectx,
 }
 
 static const char *
-nfp_elf_fwinfo_lookup(struct nfp_elf *ectx,
+nfp_elf_fwinfo_lookup(const char *strtab,
+		ssize_t tab_sz,
 		const char *key)
 {
 	size_t s_len;
 	const char *s;
 	size_t key_len = strlen(key);
-	const char *strtab = ectx->fw_info_strtab;
-	ssize_t tab_sz = (ssize_t)ectx->fw_info_strtab_sz;
 
 	if (strtab == NULL)
 		return NULL;
@@ -610,7 +609,9 @@ nfp_elf_populate_fw_mip(struct nfp_elf *ectx,
 {
 	uint8_t *pu8;
 	const char *nx;
+	ssize_t tab_sz;
 	uint64_t sh_size;
+	const char *str_tab;
 	uint64_t sh_offset;
 	uint32_t first_entry;
 	const struct nfp_mip *mip;
@@ -662,7 +663,9 @@ nfp_elf_populate_fw_mip(struct nfp_elf *ectx,
 		}
 	}
 
-	ectx->fw_mip.fw_typeid = nfp_elf_fwinfo_lookup(ectx, "TypeId");
+	str_tab = ectx->fw_info_strtab;
+	tab_sz = (ssize_t)ectx->fw_info_strtab_sz;
+	ectx->fw_mip.fw_typeid = nfp_elf_fwinfo_lookup(str_tab, tab_sz, "TypeId");
 
 	/*
 	 * TypeId will be the last reserved key-value pair, so skip
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH v2 1/8] net/nfp: fix return value check
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
@ 2024-03-14  7:40   ` Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 2/8] net/nfp: fix string overflow Chaoyong He
                     ` (6 subsequent siblings)
  7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:40 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang

CI found calling 'rte_eth_switch_domain_free()' without checking return
value.

Coverity issue: 414936
Fixes: 20eaa8e2ebae ("net/nfp: free switch domain ID on close")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/flower/nfp_flower.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/flower/nfp_flower.c b/drivers/net/nfp/flower/nfp_flower.c
index 97219ff379..303f6bd3f6 100644
--- a/drivers/net/nfp/flower/nfp_flower.c
+++ b/drivers/net/nfp/flower/nfp_flower.c
@@ -793,7 +793,8 @@ nfp_uninit_app_fw_flower(struct nfp_pf_dev *pf_dev)
 	rte_free(app_fw_flower->pf_hw);
 	nfp_mtr_priv_uninit(pf_dev);
 	nfp_flow_priv_uninit(pf_dev);
-	rte_eth_switch_domain_free(app_fw_flower->switch_domain_id);
+	if (rte_eth_switch_domain_free(app_fw_flower->switch_domain_id) != 0)
+		PMD_DRV_LOG(WARNING, "Failed to free switch domain for device");
 	rte_free(app_fw_flower);
 }
 
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH v2 2/8] net/nfp: fix string overflow
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
  2024-03-14  7:40   ` [PATCH v2 1/8] net/nfp: fix return value check Chaoyong He
@ 2024-03-14  7:40   ` Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 3/8] net/nfp: fix unreachable control flow Chaoyong He
                     ` (5 subsequent siblings)
  7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:40 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang

CI found in the logic of 'nfp_sync_pci_inner_handle_alloc()', use
'strcpy()' may cause string overflow, fix it by use 'rte_strlcpy()'.

Coverity issue: 414937
Fixes: 6b4273a03779 ("net/nfp: add synchronization module")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfpcore/nfp_sync.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/nfpcore/nfp_sync.c b/drivers/net/nfp/nfpcore/nfp_sync.c
index 8bc38d6585..686cdf8eb1 100644
--- a/drivers/net/nfp/nfpcore/nfp_sync.c
+++ b/drivers/net/nfp/nfpcore/nfp_sync.c
@@ -9,6 +9,7 @@
 #include <rte_malloc.h>
 #include <rte_memzone.h>
 #include <rte_spinlock.h>
+#include <rte_string_fns.h>
 
 #include "nfp_logs.h"
 
@@ -266,7 +267,7 @@ nfp_sync_pci_inner_handle_alloc(struct nfp_sync *sync,
 	for (i = 0; i < NFP_SYNC_PCI_MAX; i++) {
 		if (strlen(sync->pci[i].pci_name) == 0) {
 			pci_avail_id = i;
-			strcpy(sync->pci[pci_avail_id].pci_name, pci_name);
+			rte_strlcpy(sync->pci[pci_avail_id].pci_name, pci_name, PCI_PRI_STR_SIZE);
 			goto common_alloc;
 		}
 	}
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH v2 3/8] net/nfp: fix unreachable control flow
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
  2024-03-14  7:40   ` [PATCH v2 1/8] net/nfp: fix return value check Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 2/8] net/nfp: fix string overflow Chaoyong He
@ 2024-03-14  7:40   ` Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 4/8] net/nfp: fix check return value Chaoyong He
                     ` (4 subsequent siblings)
  7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:40 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang

CI found there has unreachable control flow, fix it by remove the
missing delete 'return' statement.

Coverity issue: 414938
Fixes: 369945667251 ("net/nfp: fix resource leak for device initialization")
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfp_ethdev.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/nfp/nfp_ethdev.c b/drivers/net/nfp/nfp_ethdev.c
index 31c54a595c..568de1d024 100644
--- a/drivers/net/nfp/nfp_ethdev.c
+++ b/drivers/net/nfp/nfp_ethdev.c
@@ -936,7 +936,6 @@ nfp_net_init(struct rte_eth_dev *eth_dev)
 	err = nfp_net_tlv_caps_parse(eth_dev);
 	if (err != 0) {
 		PMD_INIT_LOG(ERR, "Failed to parser TLV caps");
-		return err;
 		goto free_area;
 	}
 
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH v2 4/8] net/nfp: fix check return value
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
                     ` (2 preceding siblings ...)
  2024-03-14  7:40   ` [PATCH v2 3/8] net/nfp: fix unreachable control flow Chaoyong He
@ 2024-03-14  7:40   ` Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 5/8] net/nfp: fix unreachable loop flow Chaoyong He
                     ` (3 subsequent siblings)
  7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:40 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, long.wu, stable, Peng Zhang

CI found in 'nfp_service_disable()', not check the return value of API
'rte_service_map_lcore_set()'.

Coverity issue: 414939
Fixes: 600f6d2c7704 ("net/nfp: add service module")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfp_service.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/nfp_service.c b/drivers/net/nfp/nfp_service.c
index f49fa6addf..24d60857ac 100644
--- a/drivers/net/nfp/nfp_service.c
+++ b/drivers/net/nfp/nfp_service.c
@@ -90,6 +90,7 @@ nfp_service_enable(const struct rte_service_spec *service_spec,
 int
 nfp_service_disable(struct nfp_service_info *info)
 {
+	int ret;
 	uint32_t i;
 	const char *service_name;
 
@@ -107,10 +108,16 @@ nfp_service_disable(struct nfp_service_info *info)
 			break;
 		rte_delay_ms(1);
 	}
+
 	if (i == NFP_SERVICE_DISABLE_WAIT_COUNT)
 		PMD_DRV_LOG(ERR, "Could not stop service %s", service_name);
 
-	rte_service_map_lcore_set(info->id, info->lcore, 0);
+	ret = rte_service_map_lcore_set(info->id, info->lcore, 0);
+	if (ret != 0) {
+		PMD_DRV_LOG(DEBUG, "Could not unmap flower service");
+		return -ENOENT;
+	}
+
 	rte_service_component_unregister(info->id);
 
 	return 0;
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH v2 5/8] net/nfp: fix unreachable loop flow
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
                     ` (3 preceding siblings ...)
  2024-03-14  7:40   ` [PATCH v2 4/8] net/nfp: fix check return value Chaoyong He
@ 2024-03-14  7:40   ` Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 6/8] net/nfp: fix null pointer dereference Chaoyong He
                     ` (2 subsequent siblings)
  7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:40 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang

CI found the loop flow in 'nfp_net_flow_calculate_items()' will never
execute more than once.

Coverity issue: 414941
Fixes: c91c6512d876 ("net/nfp: support Ethernet flow item")
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfp_net_flow.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index ff6ce3ee45..251974edb4 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -180,6 +180,7 @@ static int
 nfp_net_flow_calculate_items(const struct rte_flow_item items[],
 		uint32_t *match_len)
 {
+	int ret = -EINVAL;
 	const struct rte_flow_item *item;
 
 	for (item = items; item->type != RTE_FLOW_ITEM_TYPE_END; ++item) {
@@ -187,7 +188,8 @@ nfp_net_flow_calculate_items(const struct rte_flow_item items[],
 		case RTE_FLOW_ITEM_TYPE_ETH:
 			PMD_DRV_LOG(DEBUG, "RTE_FLOW_ITEM_TYPE_ETH detected");
 			*match_len = sizeof(struct nfp_net_cmsg_match_eth);
-			return 0;
+			ret = 0;
+			break;
 		case RTE_FLOW_ITEM_TYPE_IPV4:
 			PMD_DRV_LOG(DEBUG, "RTE_FLOW_ITEM_TYPE_IPV4 detected");
 			*match_len = sizeof(struct nfp_net_cmsg_match_v4);
@@ -203,7 +205,7 @@ nfp_net_flow_calculate_items(const struct rte_flow_item items[],
 		}
 	}
 
-	return -EINVAL;
+	return ret;
 }
 
 static int
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH v2 6/8] net/nfp: fix null pointer dereference
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
                     ` (4 preceding siblings ...)
  2024-03-14  7:40   ` [PATCH v2 5/8] net/nfp: fix unreachable loop flow Chaoyong He
@ 2024-03-14  7:40   ` Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 7/8] net/nfp: fix dereference after null check Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 8/8] net/nfp: fix tainted scalar Chaoyong He
  7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:40 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Chaoyong He, stable, Long Wu, Peng Zhang

CI found there are null pointer dereference in 'nfp_flow_merge_l4()'.

Coverity issue: 414942
Fixes: 94438b093702 ("net/nfp: support TCP/UDP/SCTP flow items")
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Long Wu <long.wu@corigine.com>
Reviewed-by: Peng Zhang <peng.zhang@corigine.com>
---
 drivers/net/nfp/nfp_net_flow.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/nfp/nfp_net_flow.c b/drivers/net/nfp/nfp_net_flow.c
index 251974edb4..ea743eed73 100644
--- a/drivers/net/nfp/nfp_net_flow.c
+++ b/drivers/net/nfp/nfp_net_flow.c
@@ -349,12 +349,15 @@ nfp_flow_merge_l4(struct rte_flow *nfp_flow,
 
 		ipv4->src_port = rte_be_to_cpu_16(spec->hdr.src_port);
 		ipv4->dst_port = rte_be_to_cpu_16(spec->hdr.dst_port);
-	} else {
+	} else if (ipv6 != NULL) {
 		ipv6->src_port_mask = rte_be_to_cpu_16(mask->hdr.src_port);
 		ipv6->dst_port_mask = rte_be_to_cpu_16(mask->hdr.dst_port);
 
 		ipv6->src_port = rte_be_to_cpu_16(spec->hdr.src_port);
 		ipv6->dst_port = rte_be_to_cpu_16(spec->hdr.dst_port);
+	} else {
+		PMD_DRV_LOG(ERR, "No valid L3 layer pointer.");
+		return -EINVAL;
 	}
 
 	return 0;
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH v2 7/8] net/nfp: fix dereference after null check
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
                     ` (5 preceding siblings ...)
  2024-03-14  7:40   ` [PATCH v2 6/8] net/nfp: fix null pointer dereference Chaoyong He
@ 2024-03-14  7:40   ` Chaoyong He
  2024-03-14  7:40   ` [PATCH v2 8/8] net/nfp: fix tainted scalar Chaoyong He
  7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:40 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Peng Zhang, stable, Chaoyong He

From: Peng Zhang <peng.zhang@corigine.com>

CI found in the logic of 'nfp_elf_read_first_symtab()' has
dereference after null check problem.

Coverity issue: 415042
Fixes: c82ca09c441c ("net/nfp: add ELF module")
Cc: stable@dpdk.org

Signed-off-by: Peng Zhang <peng.zhang@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
 drivers/net/nfp/nfpcore/nfp_elf.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/nfp/nfpcore/nfp_elf.c b/drivers/net/nfp/nfpcore/nfp_elf.c
index fbd350589b..1bf68ab3e4 100644
--- a/drivers/net/nfp/nfpcore/nfp_elf.c
+++ b/drivers/net/nfp/nfpcore/nfp_elf.c
@@ -898,9 +898,10 @@ nfp_elf_read_first_symtab(struct nfp_elf *ectx)
 	size_t idx;
 	uint32_t sh_type;
 	uint64_t sh_size;
-	struct nfp_elf_elf64_shdr *sec;
+	struct nfp_elf_elf64_shdr *sec = NULL;
 
-	for (idx = 0, sec = ectx->shdrs; idx < ectx->shdrs_cnt; idx++, sec++) {
+	for (idx = 0; idx < ectx->shdrs_cnt; idx++) {
+		sec = &ectx->shdrs[idx];
 		if (sec != NULL) {
 			sh_type = rte_le_to_cpu_32(sec->sh_type);
 			if (sh_type == NFP_ELF_SHT_SYMTAB)
@@ -908,6 +909,9 @@ nfp_elf_read_first_symtab(struct nfp_elf *ectx)
 		}
 	}
 
+	if (sec == NULL)
+		return -EINVAL;
+
 	sh_size = rte_le_to_cpu_64(sec->sh_size);
 
 	if (idx < ectx->shdrs_cnt && sh_type == NFP_ELF_SHT_SYMTAB) {
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

* [PATCH v2 8/8] net/nfp: fix tainted scalar
       [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
                     ` (6 preceding siblings ...)
  2024-03-14  7:40   ` [PATCH v2 7/8] net/nfp: fix dereference after null check Chaoyong He
@ 2024-03-14  7:40   ` Chaoyong He
  7 siblings, 0 replies; 16+ messages in thread
From: Chaoyong He @ 2024-03-14  7:40 UTC (permalink / raw)
  To: dev; +Cc: oss-drivers, Peng Zhang, stable, Chaoyong He

From: Peng Zhang <peng.zhang@corigine.com>

Passing tainted expression 'ectx->fw_info_strtab_sz' to
'nfp_elf_fwinfo_lookup()', which uses it as a loop boundary.

Replace tainted expression with a temp variable to avoid
the tainted scalar coverity warning.

Coverity issue: 415051
Fixes: c82ca09c441c ("net/nfp: add ELF module")
Cc: stable@dpdk.org

Signed-off-by: Peng Zhang <peng.zhang@corigine.com>
Reviewed-by: Chaoyong He <chaoyong.he@corigine.com>
---
 drivers/net/nfp/nfpcore/nfp_elf.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/net/nfp/nfpcore/nfp_elf.c b/drivers/net/nfp/nfpcore/nfp_elf.c
index 1bf68ab3e4..cfa59ed16d 100644
--- a/drivers/net/nfp/nfpcore/nfp_elf.c
+++ b/drivers/net/nfp/nfpcore/nfp_elf.c
@@ -324,14 +324,13 @@ nfp_elf_fwinfo_next(struct nfp_elf *ectx,
 }
 
 static const char *
-nfp_elf_fwinfo_lookup(struct nfp_elf *ectx,
+nfp_elf_fwinfo_lookup(const char *strtab,
+		ssize_t tab_sz,
 		const char *key)
 {
 	size_t s_len;
 	const char *s;
 	size_t key_len = strlen(key);
-	const char *strtab = ectx->fw_info_strtab;
-	ssize_t tab_sz = (ssize_t)ectx->fw_info_strtab_sz;
 
 	if (strtab == NULL)
 		return NULL;
@@ -610,7 +609,9 @@ nfp_elf_populate_fw_mip(struct nfp_elf *ectx,
 {
 	uint8_t *pu8;
 	const char *nx;
+	ssize_t tab_sz;
 	uint64_t sh_size;
+	const char *str_tab;
 	uint64_t sh_offset;
 	uint32_t first_entry;
 	const struct nfp_mip *mip;
@@ -662,7 +663,9 @@ nfp_elf_populate_fw_mip(struct nfp_elf *ectx,
 		}
 	}
 
-	ectx->fw_mip.fw_typeid = nfp_elf_fwinfo_lookup(ectx, "TypeId");
+	str_tab = ectx->fw_info_strtab;
+	tab_sz = (ssize_t)ectx->fw_info_strtab_sz;
+	ectx->fw_mip.fw_typeid = nfp_elf_fwinfo_lookup(str_tab, tab_sz, "TypeId");
 
 	/*
 	 * TypeId will be the last reserved key-value pair, so skip
-- 
2.39.1


^ permalink raw reply	[flat|nested] 16+ messages in thread

end of thread, other threads:[~2024-03-14  7:41 UTC | newest]

Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <20240314070536.3169210-1-chaoyong.he@corigine.com>
2024-03-14  7:05 ` [PATCH 1/8] net/nfp: fix return value check Chaoyong He
2024-03-14  7:05 ` [PATCH 2/8] net/nfp: fix string overflow Chaoyong He
2024-03-14  7:05 ` [PATCH 3/8] net/nfp: fix unreachable control flow Chaoyong He
2024-03-14  7:05 ` [PATCH 4/8] net/nfp: fix check return value Chaoyong He
2024-03-14  7:05 ` [PATCH 5/8] net/nfp: fix unreachable loop flow Chaoyong He
2024-03-14  7:05 ` [PATCH 6/8] net/nfp: fix null pointer dereference Chaoyong He
2024-03-14  7:05 ` [PATCH 7/8] net/nfp: fix dereference after null check Chaoyong He
2024-03-14  7:05 ` [PATCH 8/8] net/nfp: fix tainted scalar Chaoyong He
     [not found] ` <20240314074024.3199555-1-chaoyong.he@corigine.com>
2024-03-14  7:40   ` [PATCH v2 1/8] net/nfp: fix return value check Chaoyong He
2024-03-14  7:40   ` [PATCH v2 2/8] net/nfp: fix string overflow Chaoyong He
2024-03-14  7:40   ` [PATCH v2 3/8] net/nfp: fix unreachable control flow Chaoyong He
2024-03-14  7:40   ` [PATCH v2 4/8] net/nfp: fix check return value Chaoyong He
2024-03-14  7:40   ` [PATCH v2 5/8] net/nfp: fix unreachable loop flow Chaoyong He
2024-03-14  7:40   ` [PATCH v2 6/8] net/nfp: fix null pointer dereference Chaoyong He
2024-03-14  7:40   ` [PATCH v2 7/8] net/nfp: fix dereference after null check Chaoyong He
2024-03-14  7:40   ` [PATCH v2 8/8] net/nfp: fix tainted scalar Chaoyong He

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).