From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id D52C6A04C7; Wed, 16 Sep 2020 06:32:23 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id CC4791C202; Wed, 16 Sep 2020 06:29:42 +0200 (CEST) Received: from mail-pj1-f100.google.com (mail-pj1-f100.google.com [209.85.216.100]) by dpdk.org (Postfix) with ESMTP id 9D3FE1C1B7 for ; Wed, 16 Sep 2020 06:29:18 +0200 (CEST) Received: by mail-pj1-f100.google.com with SMTP id q4so900276pjh.5 for ; Tue, 15 Sep 2020 21:29:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=YeaT9EQ7tqM5dN0eVyHdarlpiiPRO+zM6/Zb3yBE2Bw=; b=N5qCQcDIBHQOiS6kZ8CexJkv05h/9pKEBl/BzswSmKfA0DoJc8THc+fmY0mampuhKI LeHGOFw8S234pqDS7ugPMZjhL9i7jLHMiMhXTqS2aa40/5LCugwkJhapEnL8QmU80/sK cSLaFkbdLywubef0xqAGUzczYbZ5WIyVIVzRQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=YeaT9EQ7tqM5dN0eVyHdarlpiiPRO+zM6/Zb3yBE2Bw=; b=ttugYQIyXqvVVuDiTVLYuLo5t0jMBf5KckruyxfI5kodX2mwC/xvQAF1m+bjgD12pJ Jc/dOx5xKTZWIcVTIvB9vmWPHdQf2MvxfsWcUCCLK/4t76q12hF4gtgNINBF36KKi6vr WlOViUrRHkaTTpWyHCxWBpnMy1YH69DAx5G5e05wjFA+WKs8oAGGq5PRVVVHh2OOd1pQ QgXQFu73t+gMBl6FEDogJ3grLjO5Gj5YvIQ3PNbrKdkew7nb1T+2YoBvJhB2RcmvR/HB 6j8zmG9A99MFJRCYLnLY7676XW4K6M31zuK4s/v5Ij1sxtFcqpi6meN+AHfTGmzzIIVu hXDQ== X-Gm-Message-State: AOAM533ytrtG2CdQyYzHd1PAxSOfoxecG/h6g7+qAtGpAWeYfwIYG1oQ 7c1JhnJYx+0ZeWlrU3VBWjkOOyW+h4JyDwtOnoTqSPTyv7hBKEBHtfv8CVzGGLiLeox2RIIfNw9 /Z8oF7ZWK+3anSeE+aVy/vpQ7AsqlD+HsSfizT6mAjez94LOlLKPIeDhzsOL7ElNvDbSzlftQ78 Kd6w== X-Google-Smtp-Source: ABdhPJymIOaSe/HjrFuglVHkRq89wav4X5UFYyBt6CKQCSfmbNduXidJDtddmDbv8Ru0YJHiVnX1piCvEdP5 X-Received: by 2002:a17:902:ba8a:b029:d1:e5e7:be70 with SMTP id k10-20020a170902ba8ab02900d1e5e7be70mr4649150pls.74.1600230557691; Tue, 15 Sep 2020 21:29:17 -0700 (PDT) Received: from localhost.localdomain ([192.19.223.252]) by smtp-relay.gmail.com with ESMTPS id hk6sm132636pjb.6.2020.09.15.21.29.17 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 15 Sep 2020 21:29:17 -0700 (PDT) X-Relaying-Domain: broadcom.com From: Ajit Khaparde To: dev@dpdk.org Cc: Kishore Padmanabha , Shahaji Bhosle , Mike Baucom Date: Tue, 15 Sep 2020 21:28:46 -0700 Message-Id: <20200916042851.32914-21-ajit.khaparde@broadcom.com> X-Mailer: git-send-email 2.21.1 (Apple Git-122.3) In-Reply-To: <20200916042851.32914-1-ajit.khaparde@broadcom.com> References: <20200911015603.88359-1-ajit.khaparde@broadcom.com> <20200916042851.32914-1-ajit.khaparde@broadcom.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [dpdk-dev] [PATCH v2 20/25] net/bnxt: fix out of bound access in bit handling X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Kishore Padmanabha Fix out of bounds access in action bit handling. The act_val is changed to be array to resolve out of bound access issue. Fixes: 52799debdf1c ("net/bnxt: support action bitmap opcode") Signed-off-by: Kishore Padmanabha Reviewed-by: Shahaji Bhosle Reviewed-by: Mike Baucom Reviewed-by: Ajit Khaparde --- drivers/net/bnxt/tf_ulp/ulp_mapper.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/net/bnxt/tf_ulp/ulp_mapper.c b/drivers/net/bnxt/tf_ulp/ulp_mapper.c index 15682673d..732141166 100644 --- a/drivers/net/bnxt/tf_ulp/ulp_mapper.c +++ b/drivers/net/bnxt/tf_ulp/ulp_mapper.c @@ -782,7 +782,7 @@ ulp_mapper_result_field_process(struct bnxt_ulp_mapper_parms *parms, uint64_t regval; uint32_t val_size = 0, field_size = 0; uint64_t act_bit; - uint8_t act_val; + uint8_t act_val[16]; uint64_t hdr_bit; switch (fld->result_opcode) { @@ -824,19 +824,18 @@ ulp_mapper_result_field_process(struct bnxt_ulp_mapper_parms *parms, return -EINVAL; } act_bit = tfp_be_to_cpu_64(act_bit); + memset(act_val, 0, sizeof(act_val)); if (ULP_BITMAP_ISSET(parms->act_bitmap->bits, act_bit)) - act_val = 1; - else - act_val = 0; + act_val[0] = 1; if (fld->field_bit_size > ULP_BYTE_2_BITS(sizeof(act_val))) { BNXT_TF_DBG(ERR, "%s field size is incorrect\n", name); return -EINVAL; } - if (!ulp_blob_push(blob, &act_val, fld->field_bit_size)) { + if (!ulp_blob_push(blob, act_val, fld->field_bit_size)) { BNXT_TF_DBG(ERR, "%s push field failed\n", name); return -EINVAL; } - val = &act_val; + val = act_val; break; case BNXT_ULP_MAPPER_OPC_SET_TO_ENCAP_ACT_PROP_SZ: if (!ulp_operand_read(fld->result_operand, -- 2.21.1 (Apple Git-122.3)