DPDK patches and discussions
 help / color / mirror / Atom feed
From: Harman Kalra <hkalra@marvell.com>
To: <dev@dpdk.org>, Ferruh Yigit <ferruh.yigit@intel.com>,
	Anatoly Burakov <anatoly.burakov@intel.com>,
	Stephen Hemminger <sthemmin@microsoft.com>,
	"Long Li" <longli@microsoft.com>,
	Hemant Agrawal <hemant.agrawal@nxp.com>,
	"Sachin Saxena" <sachin.saxena@oss.nxp.com>,
	Jakub Grajciar <jgrajcia@cisco.com>,
	Matan Azrad <matan@nvidia.com>,
	Viacheslav Ovsiienko <viacheslavo@nvidia.com>
Cc: <david.marchand@redhat.com>, <john.mcnamara@intel.com>,
	Harman Kalra <hkalra@marvell.com>
Subject: [dpdk-dev] [PATCH 4/6] drivers: fix argument cannot be negative
Date: Mon, 1 Nov 2021 23:23:35 +0530	[thread overview]
Message-ID: <20211101175337.83358-4-hkalra@marvell.com> (raw)
In-Reply-To: <20211101175337.83358-1-hkalra@marvell.com>

This patch fixes coverity issue by adding a check for
negative event fd value.

Coverity issue: 373723,373720,373719,373718,373715,373714,373713,373710,
		373707,373706,373705,373704,373701,373700,373698,373695,
		373692,373690,373689
Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")

Signed-off-by: Harman Kalra <hkalra@marvell.com>
---
 drivers/bus/pci/linux/pci_uio.c      |  6 ++++++
 drivers/bus/pci/linux/pci_vfio.c     | 15 +++++++++++++++
 drivers/bus/pci/pci_common_uio.c     |  3 ++-
 drivers/bus/vmbus/linux/vmbus_uio.c  |  6 +++++-
 drivers/bus/vmbus/vmbus_common_uio.c |  4 +++-
 drivers/net/dpaa/dpaa_ethdev.c       |  3 +++
 drivers/net/memif/memif_socket.c     |  6 +++++-
 drivers/net/memif/rte_eth_memif.c    | 12 +++++++++---
 drivers/vdpa/mlx5/mlx5_vdpa_virtq.c  |  3 +++
 9 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/drivers/bus/pci/linux/pci_uio.c b/drivers/bus/pci/linux/pci_uio.c
index 2ee5d04672..d52125e49b 100644
--- a/drivers/bus/pci/linux/pci_uio.c
+++ b/drivers/bus/pci/linux/pci_uio.c
@@ -37,6 +37,9 @@ pci_uio_read_config(const struct rte_intr_handle *intr_handle,
 {
 	int uio_cfg_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (uio_cfg_fd < 0)
+		return -1;
+
 	return pread(uio_cfg_fd, buf, len, offset);
 }
 
@@ -46,6 +49,9 @@ pci_uio_write_config(const struct rte_intr_handle *intr_handle,
 {
 	int uio_cfg_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (uio_cfg_fd < 0)
+		return -1;
+
 	return pwrite(uio_cfg_fd, buf, len, offset);
 }
 
diff --git a/drivers/bus/pci/linux/pci_vfio.c b/drivers/bus/pci/linux/pci_vfio.c
index edcee92556..779525aa3e 100644
--- a/drivers/bus/pci/linux/pci_vfio.c
+++ b/drivers/bus/pci/linux/pci_vfio.c
@@ -49,6 +49,9 @@ pci_vfio_read_config(const struct rte_intr_handle *intr_handle,
 {
 	int vfio_dev_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (vfio_dev_fd < 0)
+		return -1;
+
 	return pread64(vfio_dev_fd, buf, len,
 	       VFIO_GET_REGION_ADDR(VFIO_PCI_CONFIG_REGION_INDEX) + offs);
 }
@@ -59,6 +62,9 @@ pci_vfio_write_config(const struct rte_intr_handle *intr_handle,
 {
 	int vfio_dev_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (vfio_dev_fd < 0)
+		return -1;
+
 	return pwrite64(vfio_dev_fd, buf, len,
 	       VFIO_GET_REGION_ADDR(VFIO_PCI_CONFIG_REGION_INDEX) + offs);
 }
@@ -1012,6 +1018,9 @@ pci_vfio_unmap_resource_primary(struct rte_pci_device *dev)
 	}
 
 #endif
+	if (rte_intr_fd_get(dev->intr_handle) < 0)
+		return -1;
+
 	if (close(rte_intr_fd_get(dev->intr_handle)) < 0) {
 		RTE_LOG(INFO, EAL, "Error when closing eventfd file descriptor for %s\n",
 			pci_addr);
@@ -1114,6 +1123,9 @@ pci_vfio_ioport_read(struct rte_pci_ioport *p,
 	const struct rte_intr_handle *intr_handle = p->dev->intr_handle;
 	int vfio_dev_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (vfio_dev_fd < 0)
+		return;
+
 	if (pread64(vfio_dev_fd, data,
 		    len, p->base + offset) <= 0)
 		RTE_LOG(ERR, EAL,
@@ -1128,6 +1140,9 @@ pci_vfio_ioport_write(struct rte_pci_ioport *p,
 	const struct rte_intr_handle *intr_handle = p->dev->intr_handle;
 	int vfio_dev_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (vfio_dev_fd < 0)
+		return;
+
 	if (pwrite64(vfio_dev_fd, data,
 		     len, p->base + offset) <= 0)
 		RTE_LOG(ERR, EAL,
diff --git a/drivers/bus/pci/pci_common_uio.c b/drivers/bus/pci/pci_common_uio.c
index 244c9a8940..76c661f054 100644
--- a/drivers/bus/pci/pci_common_uio.c
+++ b/drivers/bus/pci/pci_common_uio.c
@@ -233,7 +233,8 @@ pci_uio_unmap_resource(struct rte_pci_device *dev)
 	rte_free(uio_res);
 
 	/* close fd if in primary process */
-	close(rte_intr_fd_get(dev->intr_handle));
+	if (rte_intr_fd_get(dev->intr_handle) >= 0)
+		close(rte_intr_fd_get(dev->intr_handle));
 	uio_cfg_fd = rte_intr_dev_fd_get(dev->intr_handle);
 	if (uio_cfg_fd >= 0) {
 		close(uio_cfg_fd);
diff --git a/drivers/bus/vmbus/linux/vmbus_uio.c b/drivers/bus/vmbus/linux/vmbus_uio.c
index 9c5c1aeca3..5db70f8e0d 100644
--- a/drivers/bus/vmbus/linux/vmbus_uio.c
+++ b/drivers/bus/vmbus/linux/vmbus_uio.c
@@ -30,7 +30,8 @@ static void *vmbus_map_addr;
 /* Control interrupts */
 void vmbus_uio_irq_control(struct rte_vmbus_device *dev, int32_t onoff)
 {
-	if (write(rte_intr_fd_get(dev->intr_handle), &onoff,
+	if ((rte_intr_fd_get(dev->intr_handle) < 0) ||
+	    write(rte_intr_fd_get(dev->intr_handle), &onoff,
 		  sizeof(onoff)) < 0) {
 		VMBUS_LOG(ERR, "cannot write to %d:%s",
 			  rte_intr_fd_get(dev->intr_handle),
@@ -43,6 +44,9 @@ int vmbus_uio_irq_read(struct rte_vmbus_device *dev)
 	int32_t count;
 	int cc;
 
+	if (rte_intr_fd_get(dev->intr_handle) < 0)
+		return -1;
+
 	cc = read(rte_intr_fd_get(dev->intr_handle), &count,
 		  sizeof(count));
 	if (cc < (int)sizeof(count)) {
diff --git a/drivers/bus/vmbus/vmbus_common_uio.c b/drivers/bus/vmbus/vmbus_common_uio.c
index 336296d6a8..882a24f869 100644
--- a/drivers/bus/vmbus/vmbus_common_uio.c
+++ b/drivers/bus/vmbus/vmbus_common_uio.c
@@ -258,7 +258,9 @@ vmbus_uio_unmap_resource(struct rte_vmbus_device *dev)
 	rte_free(uio_res);
 
 	/* close fd if in primary process */
-	close(rte_intr_fd_get(dev->intr_handle));
+	if (rte_intr_fd_get(dev->intr_handle) >= 0)
+		close(rte_intr_fd_get(dev->intr_handle));
+
 	if (rte_intr_dev_fd_get(dev->intr_handle) >= 0) {
 		close(rte_intr_dev_fd_get(dev->intr_handle));
 		rte_intr_dev_fd_set(dev->intr_handle, -1);
diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index b9bf9d2966..e49f765434 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -371,6 +371,9 @@ static void dpaa_interrupt_handler(void *param)
 	dpaa_dev = container_of(rdev, struct rte_dpaa_device, device);
 	intr_handle = dpaa_dev->intr_handle;
 
+	if (rte_intr_fd_get(intr_handle) < 0)
+		return;
+
 	bytes_read = read(rte_intr_fd_get(intr_handle), &buf,
 			  sizeof(uint64_t));
 	if (bytes_read < 0)
diff --git a/drivers/net/memif/memif_socket.c b/drivers/net/memif/memif_socket.c
index d48c3685d9..c845c20ccf 100644
--- a/drivers/net/memif/memif_socket.c
+++ b/drivers/net/memif/memif_socket.c
@@ -508,7 +508,8 @@ memif_intr_unregister_handler(struct rte_intr_handle *intr_handle, void *arg)
 	struct memif_control_channel *cc = arg;
 
 	/* close control channel fd */
-	close(rte_intr_fd_get(intr_handle));
+	if (rte_intr_fd_get(intr_handle) >= 0)
+		close(rte_intr_fd_get(intr_handle));
 	/* clear message queue */
 	while ((elt = TAILQ_FIRST(&cc->msg_queue)) != NULL) {
 		TAILQ_REMOVE(&cc->msg_queue, elt, next);
@@ -651,6 +652,9 @@ memif_msg_receive(struct memif_control_channel *cc)
 	mh.msg_control = ctl;
 	mh.msg_controllen = sizeof(ctl);
 
+	if (rte_intr_fd_get(cc->intr_handle) < 0)
+		return -1;
+
 	size = recvmsg(rte_intr_fd_get(cc->intr_handle), &mh, 0);
 	if (size != sizeof(memif_msg_t)) {
 		MIF_LOG(DEBUG, "Invalid message size = %zd", size);
diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index 8cec493ffd..2935ae6ebe 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -325,7 +325,8 @@ eth_memif_rx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 	}
 
 	/* consume interrupt */
-	if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0)
+	if (((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) &&
+	    (rte_intr_fd_get(mq->intr_handle) >= 0))
 		size = read(rte_intr_fd_get(mq->intr_handle), &b,
 			    sizeof(b));
 
@@ -460,7 +461,8 @@ eth_memif_rx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 	}
 
 	/* consume interrupt */
-	if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) {
+	if ((rte_intr_fd_get(mq->intr_handle) >= 0) &&
+	    ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0)) {
 		uint64_t b;
 		ssize_t size __rte_unused;
 		size = read(rte_intr_fd_get(mq->intr_handle), &b,
@@ -680,7 +682,8 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 	else
 		__atomic_store_n(&ring->tail, slot, __ATOMIC_RELEASE);
 
-	if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) {
+	if (((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) &&
+	    (rte_intr_fd_get(mq->intr_handle) >= 0)) {
 		a = 1;
 		size = write(rte_intr_fd_get(mq->intr_handle), &a,
 			     sizeof(a));
@@ -835,6 +838,9 @@ eth_memif_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 	/* Send interrupt, if enabled. */
 	if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) {
 		uint64_t a = 1;
+		if (rte_intr_fd_get(mq->intr_handle) < 0)
+			return -1;
+
 		ssize_t size = write(rte_intr_fd_get(mq->intr_handle),
 				     &a, sizeof(a));
 		if (unlikely(size < 0)) {
diff --git a/drivers/vdpa/mlx5/mlx5_vdpa_virtq.c b/drivers/vdpa/mlx5/mlx5_vdpa_virtq.c
index cb37ba097c..db971bad48 100644
--- a/drivers/vdpa/mlx5/mlx5_vdpa_virtq.c
+++ b/drivers/vdpa/mlx5/mlx5_vdpa_virtq.c
@@ -24,6 +24,9 @@ mlx5_vdpa_virtq_handler(void *cb_arg)
 	uint64_t buf;
 	int nbytes;
 
+	if (rte_intr_fd_get(virtq->intr_handle) < 0)
+		return;
+
 	do {
 		nbytes = read(rte_intr_fd_get(virtq->intr_handle), &buf,
 			      8);
-- 
2.18.0


  parent reply	other threads:[~2021-11-01 17:54 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-01 17:53 [dpdk-dev] [PATCH 1/6] interrupts: " Harman Kalra
2021-11-01 17:53 ` [dpdk-dev] [PATCH 2/6] lib: " Harman Kalra
2021-11-01 17:53 ` [dpdk-dev] [PATCH 3/6] drivers: fix bad bit shift operation Harman Kalra
2021-11-02  1:22   ` Wang, Haiyue
2021-11-01 17:53 ` Harman Kalra [this message]
2021-11-01 17:53 ` [dpdk-dev] [PATCH 5/6] drivers: fix improper use of negative value Harman Kalra
2021-11-01 17:53 ` [dpdk-dev] [PATCH 6/6] net/mlx4: fix dereference after null check Harman Kalra
2021-11-02  7:34   ` Slava Ovsiienko
2021-11-08 16:32     ` David Marchand

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211101175337.83358-4-hkalra@marvell.com \
    --to=hkalra@marvell.com \
    --cc=anatoly.burakov@intel.com \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    --cc=ferruh.yigit@intel.com \
    --cc=hemant.agrawal@nxp.com \
    --cc=jgrajcia@cisco.com \
    --cc=john.mcnamara@intel.com \
    --cc=longli@microsoft.com \
    --cc=matan@nvidia.com \
    --cc=sachin.saxena@oss.nxp.com \
    --cc=sthemmin@microsoft.com \
    --cc=viacheslavo@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).