DPDK patches and discussions
 help / color / mirror / Atom feed
From: Andy Pei <andy.pei@intel.com>
To: dev@dpdk.org
Cc: andy.pei@intel.com, rosen.xu@intel.com, stable@dpdk.org
Subject: [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference
Date: Thu, 23 May 2019 12:31:22 +0800	[thread overview]
Message-ID: <1558585882-222368-1-git-send-email-andy.pei@intel.com> (raw)

In current code, scenario may happens that
when function ipn3ke_hw_tm_node_wr is called,
struct ipn3ke_tm_node n has a NULL element
parent_node, however, the element parent_node
of struct ipn3ke_tm_node n is used in an invalid way.
After applying this patch,
this null pointer dereference is avoided.

Coverity issue: 337921
Fixes: c820468ac99c ("net/ipn3ke: support TM")
Cc: rosen.xu@intel.com
Cc: stable@dpdk.org

Signed-off-by: Andy Pei <andy.pei@intel.com>
---
 drivers/net/ipn3ke/ipn3ke_tm.c | 43 +++++++++++++++++++++++-------------------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/drivers/net/ipn3ke/ipn3ke_tm.c b/drivers/net/ipn3ke/ipn3ke_tm.c
index 4bcf3aa..30a3dfd 100644
--- a/drivers/net/ipn3ke/ipn3ke_tm.c
+++ b/drivers/net/ipn3ke/ipn3ke_tm.c
@@ -1579,7 +1579,8 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 
 static int
 ipn3ke_hw_tm_node_wr(struct ipn3ke_hw *hw,
-				struct ipn3ke_tm_node *n)
+	struct ipn3ke_tm_node *n,
+	struct ipn3ke_tm_node *parent_node)
 {
 	uint32_t level;
 
@@ -1650,11 +1651,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 		/**
 		 * Configure Map
 		 */
-		IPN3KE_MASK_WRITE_REG(hw,
-				IPN3KE_QOS_MAP_L2_X,
-				n->node_index,
-				n->parent_node->node_index,
-				IPN3KE_QOS_MAP_L2_MASK);
+		if (parent_node)
+			IPN3KE_MASK_WRITE_REG(hw,
+					IPN3KE_QOS_MAP_L2_X,
+					n->node_index,
+					parent_node->node_index,
+					IPN3KE_QOS_MAP_L2_MASK);
 
 		break;
 	case IPN3KE_TM_NODE_LEVEL_COS:
@@ -1707,11 +1709,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 					0x80000000))
 			;
 
-		IPN3KE_MASK_WRITE_REG(hw,
-			IPN3KE_QM_UID_CONFIG_DATA,
-			0,
-			(1 << 8 | n->parent_node->parent_node->node_index),
-			0x1FF);
+		if (parent_node && parent_node->parent_node)
+			IPN3KE_MASK_WRITE_REG(hw,
+				IPN3KE_QM_UID_CONFIG_DATA,
+				0,
+				(1 << 8 | parent_node->parent_node->node_index),
+				0x1FF);
 
 		IPN3KE_MASK_WRITE_REG(hw,
 				IPN3KE_QM_UID_CONFIG_CTRL,
@@ -1728,11 +1731,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 		/**
 		 * Configure Map
 		 */
-		IPN3KE_MASK_WRITE_REG(hw,
-				IPN3KE_QOS_MAP_L1_X,
-				n->node_index,
-				n->parent_node->node_index,
-				IPN3KE_QOS_MAP_L1_MASK);
+		if (parent_node)
+			IPN3KE_MASK_WRITE_REG(hw,
+					IPN3KE_QOS_MAP_L1_X,
+					n->node_index,
+					parent_node->node_index,
+					IPN3KE_QOS_MAP_L1_MASK);
 
 		break;
 	default:
@@ -1772,7 +1776,8 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 						NULL,
 						rte_strerror(EINVAL));
 		}
-		ipn3ke_hw_tm_node_wr(hw, n);
+		parent_node = n->parent_node;
+		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
 	}
 
 	nl = &tm->h.vt_commit_node_list;
@@ -1802,7 +1807,7 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 						NULL,
 						rte_strerror(EINVAL));
 		}
-		ipn3ke_hw_tm_node_wr(hw, n);
+		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
 	}
 
 	nl = &tm->h.cos_commit_node_list;
@@ -1836,7 +1841,7 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 						NULL,
 						rte_strerror(EINVAL));
 		}
-		ipn3ke_hw_tm_node_wr(hw, n);
+		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
 	}
 
 	return 0;
-- 
1.8.3.1


             reply	other threads:[~2019-05-23  4:37 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-23  4:31 Andy Pei [this message]
2019-05-23  5:20 ` Xu, Rosen
2019-06-18 13:32   ` Zhang, Qi Z

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1558585882-222368-1-git-send-email-andy.pei@intel.com \
    --to=andy.pei@intel.com \
    --cc=dev@dpdk.org \
    --cc=rosen.xu@intel.com \
    --cc=stable@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).