DPDK patches and discussions
 help / color / mirror / Atom feed
From: Andrew Rybchenko <andrew.rybchenko@oktetlabs.ru>
To: Matan Azrad <matan@nvidia.com>,
	Shahaf Shuler <shahafs@nvidia.com>,
	Viacheslav Ovsiienko <viacheslavo@nvidia.com>,
	Thomas Monjalon <thomas@monjalon.net>,
	Ferruh Yigit <ferruh.yigit@intel.com>,
	Xueming Li <xuemingl@nvidia.com>
Cc: dev@dpdk.org,
	Viacheslav Galaktionov <viacheslav.galaktionov@oktetlabs.ru>,
	stable@dpdk.org
Subject: [dpdk-dev] [PATCH v2] ethdev: keep count of allocated and used representor ranges
Date: Mon,  5 Jul 2021 13:02:52 +0300
Message-ID: <20210705100252.1840901-1-andrew.rybchenko@oktetlabs.ru> (raw)
In-Reply-To: <20210702142322.821302-1-andrew.rybchenko@oktetlabs.ru>

From: Viacheslav Galaktionov <viacheslav.galaktionov@oktetlabs.ru>

In its current state, the API can overflow the user-passed buffer if a new
representor range appears between function calls.

In order to solve this problem, augment the representor info structure with
the numbers of allocated and initialized ranges. This way the users of this
structure can be sure they will not overrun the buffer.

Fixes: 85e1588ca72f ("ethdev: add API to get representor info")
Cc: stable@dpdk.org

Signed-off-by: Viacheslav Galaktionov <viacheslav.galaktionov@oktetlabs.ru>
Signed-off-by: Andrew Rybchenko <andrew.rybchenko@oktetlabs.ru>
---
v2:
 - fixed a potential null pointer dereference

 drivers/net/mlx5/mlx5_ethdev.c | 15 +++++++++++++++
 lib/ethdev/rte_ethdev.c        |  6 ++++--
 lib/ethdev/rte_ethdev.h        |  9 ++++++++-
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_ethdev.c b/drivers/net/mlx5/mlx5_ethdev.c
index 90baee5aa4..c32eeefd88 100644
--- a/drivers/net/mlx5/mlx5_ethdev.c
+++ b/drivers/net/mlx5/mlx5_ethdev.c
@@ -413,9 +413,15 @@ mlx5_representor_info_get(struct rte_eth_dev *dev,
 	int n_type = 4; /* Representor types, VF, HPF@VF, SF and HPF@SF. */
 	int n_pf = 2; /* Number of PFs. */
 	int i = 0, pf;
+	int n_entries;
 
 	if (info == NULL)
 		goto out;
+
+	n_entries = n_type * n_pf;
+	if ((uint32_t)n_entries > info->nb_ranges_alloc)
+		n_entries = info->nb_ranges_alloc;
+
 	info->controller = 0;
 	info->pf = priv->pf_bond >= 0 ? priv->pf_bond : 0;
 	for (pf = 0; pf < n_pf; ++pf) {
@@ -431,6 +437,8 @@ mlx5_representor_info_get(struct rte_eth_dev *dev,
 		snprintf(info->ranges[i].name,
 			 sizeof(info->ranges[i].name), "pf%dvf", pf);
 		i++;
+		if (i == n_entries)
+			break;
 		/* HPF range of VF type. */
 		info->ranges[i].type = RTE_ETH_REPRESENTOR_VF;
 		info->ranges[i].controller = 0;
@@ -443,6 +451,8 @@ mlx5_representor_info_get(struct rte_eth_dev *dev,
 		snprintf(info->ranges[i].name,
 			 sizeof(info->ranges[i].name), "pf%dvf", pf);
 		i++;
+		if (i == n_entries)
+			break;
 		/* SF range. */
 		info->ranges[i].type = RTE_ETH_REPRESENTOR_SF;
 		info->ranges[i].controller = 0;
@@ -455,6 +465,8 @@ mlx5_representor_info_get(struct rte_eth_dev *dev,
 		snprintf(info->ranges[i].name,
 			 sizeof(info->ranges[i].name), "pf%dsf", pf);
 		i++;
+		if (i == n_entries)
+			break;
 		/* HPF range of SF type. */
 		info->ranges[i].type = RTE_ETH_REPRESENTOR_SF;
 		info->ranges[i].controller = 0;
@@ -467,7 +479,10 @@ mlx5_representor_info_get(struct rte_eth_dev *dev,
 		snprintf(info->ranges[i].name,
 			 sizeof(info->ranges[i].name), "pf%dsf", pf);
 		i++;
+		if (i == n_entries)
+			break;
 	}
+	info->nb_ranges = i;
 out:
 	return n_type * n_pf;
 }
diff --git a/lib/ethdev/rte_ethdev.c b/lib/ethdev/rte_ethdev.c
index c607eabb5b..30abc93b18 100644
--- a/lib/ethdev/rte_ethdev.c
+++ b/lib/ethdev/rte_ethdev.c
@@ -5987,7 +5987,8 @@ rte_eth_representor_id_get(const struct rte_eth_dev *ethdev,
 			   int controller, int pf, int representor_port,
 			   uint16_t *repr_id)
 {
-	int ret, n, i, count;
+	int ret, n, count;
+	uint32_t i;
 	struct rte_eth_representor_info *info = NULL;
 	size_t size;
 
@@ -6011,6 +6012,7 @@ rte_eth_representor_id_get(const struct rte_eth_dev *ethdev,
 	info = calloc(1, size);
 	if (info == NULL)
 		return -ENOMEM;
+	info->nb_ranges_alloc = n;
 	ret = rte_eth_representor_info_get(ethdev->data->port_id, info);
 	if (ret < 0)
 		goto out;
@@ -6023,7 +6025,7 @@ rte_eth_representor_id_get(const struct rte_eth_dev *ethdev,
 
 	/* Locate representor ID. */
 	ret = -ENOENT;
-	for (i = 0; i < n; ++i) {
+	for (i = 0; i < info->nb_ranges; ++i) {
 		if (info->ranges[i].type != type)
 			continue;
 		if (info->ranges[i].controller != controller)
diff --git a/lib/ethdev/rte_ethdev.h b/lib/ethdev/rte_ethdev.h
index faf3bd901d..d2b27c351f 100644
--- a/lib/ethdev/rte_ethdev.h
+++ b/lib/ethdev/rte_ethdev.h
@@ -4856,6 +4856,8 @@ struct rte_eth_representor_range {
 struct rte_eth_representor_info {
 	uint16_t controller; /**< Controller ID of caller device. */
 	uint16_t pf; /**< Physical function ID of caller device. */
+	uint32_t nb_ranges_alloc; /**< Size of the ranges array. */
+	uint32_t nb_ranges; /**< Number of initialized ranges. */
 	struct rte_eth_representor_range ranges[];/**< Representor ID range. */
 };
 
@@ -4871,11 +4873,16 @@ struct rte_eth_representor_info {
  *   A pointer to a representor info structure.
  *   NULL to return number of range entries and allocate memory
  *   for next call to store detail.
+ *   The number of ranges that were written into this structure
+ *   will be placed into its nb_ranges field. This number cannot be
+ *   larger than the nb_ranges_alloc that by the user before calling
+ *   this function. It can be smaller than the value returned by the
+ *   function, however.
  * @return
  *   - (-ENOTSUP) if operation is not supported.
  *   - (-ENODEV) if *port_id* invalid.
  *   - (-EIO) if device is removed.
- *   - (>=0) number of representor range entries supported by device.
+ *   - (>=0) number of available representor range entries.
  */
 __rte_experimental
 int rte_eth_representor_info_get(uint16_t port_id,
-- 
2.30.2


  parent reply	other threads:[~2021-07-05 10:03 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-02 14:23 [dpdk-dev] [PATCH] " Andrew Rybchenko
2021-07-03  1:32 ` Xueming(Steven) Li
2021-07-03 10:01   ` Viacheslav Galaktionov
2021-07-05  2:50     ` Xueming(Steven) Li
2021-07-05 10:02 ` Andrew Rybchenko [this message]
2021-07-05 11:07   ` [dpdk-dev] [PATCH v2] " Xueming(Steven) Li
2021-07-10  9:46     ` Thomas Monjalon

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210705100252.1840901-1-andrew.rybchenko@oktetlabs.ru \
    --to=andrew.rybchenko@oktetlabs.ru \
    --cc=dev@dpdk.org \
    --cc=ferruh.yigit@intel.com \
    --cc=matan@nvidia.com \
    --cc=shahafs@nvidia.com \
    --cc=stable@dpdk.org \
    --cc=thomas@monjalon.net \
    --cc=viacheslav.galaktionov@oktetlabs.ru \
    --cc=viacheslavo@nvidia.com \
    --cc=xuemingl@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

DPDK patches and discussions

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://inbox.dpdk.org/dev/0 dev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 dev dev/ https://inbox.dpdk.org/dev \
		dev@dpdk.org
	public-inbox-index dev

Example config snippet for mirrors.
Newsgroup available over NNTP:
	nntp://inbox.dpdk.org/inbox.dpdk.dev


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git