From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 41E4CA00C5; Thu, 7 May 2020 11:11:08 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 90CD21DAFC; Thu, 7 May 2020 11:11:07 +0200 (CEST) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by dpdk.org (Postfix) with ESMTP id 2C44A1DAF4 for ; Thu, 7 May 2020 11:11:05 +0200 (CEST) IronPort-SDR: tO/UdDtqk1NNs0OQjGhf8eug0M5GIEFk5gdSu5rK+TXvKDeoGu+E/5Zve74nmUQ1QPuvhlE35o 2qG8GovQa4Mg== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 May 2020 02:11:05 -0700 IronPort-SDR: XnARcb1QFJUdqIpMd5BCtX8cHcy0czav4ig3eyU0sQJo3FUVcF4TPxWp5VLQYCc/z2cn3ceZ19 xxK7Zip0K+Gg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,363,1583222400"; d="scan'208";a="295656293" Received: from shwdenpg235.ccr.corp.intel.com ([10.240.182.60]) by fmsmga002.fm.intel.com with ESMTP; 07 May 2020 02:11:02 -0700 From: alvinx.zhang@intel.com To: dev@dpdk.org Cc: wei.zhao1@intel.com, jia.guo@intel.com, xiaolong.ye@intel.com Date: Thu, 7 May 2020 17:08:53 +0800 Message-Id: <20200507090853.16832-1-alvinx.zhang@intel.com> X-Mailer: git-send-email 2.21.0.windows.1 In-Reply-To: <20200507020133.14412-1-alvinx.zhang@intel.com> References: <20200507020133.14412-1-alvinx.zhang@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [dpdk-dev] [PATCH v2] net/igc: fix memory illegal accesses X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Alvin Zhang Fix some out-of-bounds memory issues, they may lead to wrong results or affect application stability. Fixes: bd3fcf0d0fa1 (net/igc: support RSS) Cc: stable@dpdk.org Signed-off-by: Alvin Zhang V2: update git log --- drivers/net/igc/igc_ethdev.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/igc/igc_ethdev.c b/drivers/net/igc/igc_ethdev.c index 16d98c6..6ab3ee9 100644 --- a/drivers/net/igc/igc_ethdev.c +++ b/drivers/net/igc/igc_ethdev.c @@ -2266,6 +2266,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, return -EINVAL; } + RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); + /* set redirection table */ for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { union igc_rss_reta_reg reta, reg; @@ -2278,7 +2280,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RSS_RDT_REG_SIZE_MASK); /* if no need to update the register */ - if (!mask) + if (!mask || + shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) continue; /* check mask whether need to read the register value first */ @@ -2289,6 +2292,7 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); /* update the register */ + RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { if (mask & (1u << j)) reta.bytes[j] = @@ -2318,6 +2322,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, return -EINVAL; } + RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); + /* read redirection table */ for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { union igc_rss_reta_reg reta; @@ -2330,10 +2336,12 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RSS_RDT_REG_SIZE_MASK); /* if no need to read register */ - if (!mask) + if (!mask || + shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) continue; /* read register and get the queue index */ + RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); reta.dword = IGC_READ_REG_LE_VALUE(hw, IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { -- 1.8.3.1