From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id D1506A00C5; Fri, 8 May 2020 10:34:55 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 2E79E1DA00; Fri, 8 May 2020 10:34:55 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by dpdk.org (Postfix) with ESMTP id 1117F1D9F6 for ; Fri, 8 May 2020 10:34:52 +0200 (CEST) IronPort-SDR: Njyrv45UFN3+fz+wMmIeCUi4vJR0u+X1mLlMnepQOkL+6yqFAkRiixWmesVDKkGaRQCI2NFEn4 +FxchgP3uYyA== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 May 2020 01:34:52 -0700 IronPort-SDR: mJuDtxfC5NR68wP+oSTjoy81NSMePDqEIbPJ4j8uWuLFyABf+0pVNDgH4HAut0of8jAxA0JtRW Yv2dkgmu6T8w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,366,1583222400"; d="scan'208";a="462151091" Received: from yexl-server.sh.intel.com (HELO localhost) ([10.67.116.183]) by fmsmga005.fm.intel.com with ESMTP; 08 May 2020 01:34:50 -0700 Date: Fri, 8 May 2020 16:27:00 +0800 From: Ye Xiaolong To: alvinx.zhang@intel.com Cc: dev@dpdk.org, wei.zhao1@intel.com, jia.guo@intel.com Message-ID: <20200508082700.GD75514@intel.com> References: <20200507090853.16832-1-alvinx.zhang@intel.com> <20200507093156.18616-1-alvinx.zhang@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200507093156.18616-1-alvinx.zhang@intel.com> User-Agent: Mutt/1.9.4 (2018-02-28) Subject: Re: [dpdk-dev] [PATCH v2] net/igc: fix memory illegal accesses X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On 05/07, alvinx.zhang@intel.com wrote: >From: Alvin Zhang > >Fix some out-of-bounds memory issues, they may lead to wrong results >or affect application stability. > >Fixes: bd3fcf0d0fa1 (net/igc: support RSS) >Cc: stable@dpdk.org Please append the coverity number, you can refer to other fixes in the commit history. Thanks, Xiaolong > >Signed-off-by: Alvin Zhang >--- > >V2: update git log > > drivers/net/igc/igc_ethdev.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > >diff --git a/drivers/net/igc/igc_ethdev.c b/drivers/net/igc/igc_ethdev.c >index 16d98c6..6ab3ee9 100644 >--- a/drivers/net/igc/igc_ethdev.c >+++ b/drivers/net/igc/igc_ethdev.c >@@ -2266,6 +2266,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > return -EINVAL; > } > >+ RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); >+ > /* set redirection table */ > for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { > union igc_rss_reta_reg reta, reg; >@@ -2278,7 +2280,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > IGC_RSS_RDT_REG_SIZE_MASK); > > /* if no need to update the register */ >- if (!mask) >+ if (!mask || >+ shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) > continue; > > /* check mask whether need to read the register value first */ >@@ -2289,6 +2292,7 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); > > /* update the register */ >+ RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); > for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { > if (mask & (1u << j)) > reta.bytes[j] = >@@ -2318,6 +2322,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > return -EINVAL; > } > >+ RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); >+ > /* read redirection table */ > for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { > union igc_rss_reta_reg reta; >@@ -2330,10 +2336,12 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > IGC_RSS_RDT_REG_SIZE_MASK); > > /* if no need to read register */ >- if (!mask) >+ if (!mask || >+ shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) > continue; > > /* read register and get the queue index */ >+ RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); > reta.dword = IGC_READ_REG_LE_VALUE(hw, > IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); > for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { >-- >1.8.3.1 >