[PATCH v1 0/1] baseband/acc: coverity fix RC2

[PATCH v1 0/1] baseband/acc: coverity fix RC2

[Hernan Vargas]

Fix for coverity issues 381631, 381646 raised on RC2 for the ACC100 PMD.

Hernan Vargas (1):
  baseband/acc: fix check after deref and dead code

 drivers/baseband/acc/rte_acc100_pmd.c | 4 ----
 1 file changed, 4 deletions(-)

-- 
2.37.1

[PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Hernan Vargas]

Fix potential issue of dereferencing a pointer before null check.
Remove null check for value that could never be null.

Coverity issue: 381646, 381631
Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")

Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
---
 drivers/baseband/acc/rte_acc100_pmd.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/baseband/acc/rte_acc100_pmd.c b/drivers/baseband/acc/rte_acc100_pmd.c
index 96daef87bc..30a718916d 100644
--- a/drivers/baseband/acc/rte_acc100_pmd.c
+++ b/drivers/baseband/acc/rte_acc100_pmd.c
@@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct rte_bbdev_queue_data *q_data,
 	struct rte_bbdev_enc_op *op;
 	union acc_dma_desc *desc;
 
-	if (q == NULL)
-		return 0;
 #ifdef RTE_LIBRTE_BBDEV_DEBUG
 	if (unlikely(ops == 0))
 		return 0;
 #endif
 	desc = q->ring_addr + (q->sw_ring_tail & q->sw_ring_wrap_mask);
-	if (unlikely(desc == NULL))
-		return 0;
 	op = desc->req.op_addr;
 	if (unlikely(ops == NULL || op == NULL))
 		return 0;
-- 
2.37.1

Re: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Maxime Coquelin]

On 11/4/22 04:52, Hernan Vargas wrote:
> Fix potential issue of dereferencing a pointer before null check.
> Remove null check for value that could never be null.
> 
> Coverity issue: 381646, 381631
> Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")
> 
> Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
> ---
>   drivers/baseband/acc/rte_acc100_pmd.c | 4 ----
>   1 file changed, 4 deletions(-)
> 
> diff --git a/drivers/baseband/acc/rte_acc100_pmd.c b/drivers/baseband/acc/rte_acc100_pmd.c
> index 96daef87bc..30a718916d 100644
> --- a/drivers/baseband/acc/rte_acc100_pmd.c
> +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct rte_bbdev_queue_data *q_data,
>   	struct rte_bbdev_enc_op *op;
>   	union acc_dma_desc *desc;
>   
> -	if (q == NULL)
> -		return 0;

Can we be sure it can never be NULL?

static inline uint16_t
rte_bbdev_dequeue_ldpc_enc_ops(uint16_t dev_id, uint16_t queue_id,
		struct rte_bbdev_enc_op **ops, uint16_t num_ops)
{
	struct rte_bbdev *dev = &rte_bbdev_devices[dev_id];
	struct rte_bbdev_queue_data *q_data = &dev->data->queues[queue_id];
	return dev->dequeue_ldpc_enc_ops(q_data, ops, num_ops);
}

If the application passes an invalid queue_id or dev_id you can easily
get garbage.

It may be worth adding some checks in all the helpers, to be sure dev_id
is valid, and same for queue_id. We do that in Vhost library to improve
robustness.

I know there is this comment:
"
  * This function does not provide any error notification to avoid the
  * corresponding overhead.
"

But to me this is not a good justification, the overhead would be
minimal.

Regards,
Maxime

>   #ifdef RTE_LIBRTE_BBDEV_DEBUG
>   	if (unlikely(ops == 0))
>   		return 0;
>   #endif
>   	desc = q->ring_addr + (q->sw_ring_tail & q->sw_ring_wrap_mask);
> -	if (unlikely(desc == NULL))
> -		return 0;
>   	op = desc->req.op_addr;
>   	if (unlikely(ops == NULL || op == NULL))
>   		return 0;

RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Chautru, Nicolas]

Hi Maxime, 

> -----Original Message-----
> From: Maxime Coquelin <maxime.coquelin@redhat.com>
> Sent: Friday, November 4, 2022 1:52 AM
> To: Vargas, Hernan <hernan.vargas@intel.com>; dev@dpdk.org;
> gakhil@marvell.com; trix@redhat.com
> Cc: Chautru, Nicolas <nicolas.chautru@intel.com>; Zhang, Qi Z
> <qi.z.zhang@intel.com>
> Subject: Re: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code
> 
> 
> 
> On 11/4/22 04:52, Hernan Vargas wrote:
> > Fix potential issue of dereferencing a pointer before null check.
> > Remove null check for value that could never be null.
> >
> > Coverity issue: 381646, 381631
> > Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")
> >
> > Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
> > ---
> >   drivers/baseband/acc/rte_acc100_pmd.c | 4 ----
> >   1 file changed, 4 deletions(-)
> >
> > diff --git a/drivers/baseband/acc/rte_acc100_pmd.c
> > b/drivers/baseband/acc/rte_acc100_pmd.c
> > index 96daef87bc..30a718916d 100644
> > --- a/drivers/baseband/acc/rte_acc100_pmd.c
> > +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> > @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct
> rte_bbdev_queue_data *q_data,
> >   	struct rte_bbdev_enc_op *op;
> >   	union acc_dma_desc *desc;
> >
> > -	if (q == NULL)
> > -		return 0;
> 
> Can we be sure it can never be NULL?
> 
> static inline uint16_t
> rte_bbdev_dequeue_ldpc_enc_ops(uint16_t dev_id, uint16_t queue_id,
> 		struct rte_bbdev_enc_op **ops, uint16_t num_ops) {
> 	struct rte_bbdev *dev = &rte_bbdev_devices[dev_id];
> 	struct rte_bbdev_queue_data *q_data = &dev->data-
> >queues[queue_id];
> 	return dev->dequeue_ldpc_enc_ops(q_data, ops, num_ops); }
> 
> If the application passes an invalid queue_id or dev_id you can easily get
> garbage.
> 
> It may be worth adding some checks in all the helpers, to be sure dev_id is
> valid, and same for queue_id. We do that in Vhost library to improve
> robustness.
> 
> I know there is this comment:
> "
>   * This function does not provide any error notification to avoid the
>   * corresponding overhead.
> "
> 
> But to me this is not a good justification, the overhead would be minimal.
> 

Thanks. 
The rational is that this function needs to be very lightweight since this is a called in loop and hence this is was captured
explicitly in bbdev. 
More generally I don’t believe that a change to bbdev would be relevant in that ticket, ok to move that discussion for later on in any case?

This ticket is purely about a Coverity fix for the ACC100 PMD. Note that we don’t check for q null during dequeue in most baseband PMD (including both intel and non-intel ones), this one was not required either, only historical. 
Does that sound fair in the context of that Coverity fix?
Thanks
Nic


> Regards,
> Maxime
> 
> >   #ifdef RTE_LIBRTE_BBDEV_DEBUG
> >   	if (unlikely(ops == 0))
> >   		return 0;
> >   #endif
> >   	desc = q->ring_addr + (q->sw_ring_tail & q->sw_ring_wrap_mask);
> > -	if (unlikely(desc == NULL))
> > -		return 0;
> >   	op = desc->req.op_addr;
> >   	if (unlikely(ops == NULL || op == NULL))
> >   		return 0;

RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Chautru, Nicolas]

Hi Maxime, Akhil, 
This patch is not applied yet.
Any concern to apply this as is?
Maxime, unclear whether you recommend a change for this in the context of the coverify fix. Please kindly clarify. Do you want to keep the q == null in the PMD? 
Thanks
Nic

> -----Original Message-----
> From: Chautru, Nicolas
> Sent: Friday, November 4, 2022 10:39 AM
> To: Maxime Coquelin <maxime.coquelin@redhat.com>; Vargas, Hernan
> <Hernan.Vargas@intel.com>; dev@dpdk.org; gakhil@marvell.com;
> trix@redhat.com
> Cc: Zhang, Qi Z <qi.z.zhang@intel.com>
> Subject: RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code
> 
> Hi Maxime,
> 
> > -----Original Message-----
> > From: Maxime Coquelin <maxime.coquelin@redhat.com>
> > Sent: Friday, November 4, 2022 1:52 AM
> > To: Vargas, Hernan <hernan.vargas@intel.com>; dev@dpdk.org;
> > gakhil@marvell.com; trix@redhat.com
> > Cc: Chautru, Nicolas <nicolas.chautru@intel.com>; Zhang, Qi Z
> > <qi.z.zhang@intel.com>
> > Subject: Re: [PATCH v1 1/1] baseband/acc: fix check after deref and
> > dead code
> >
> >
> >
> > On 11/4/22 04:52, Hernan Vargas wrote:
> > > Fix potential issue of dereferencing a pointer before null check.
> > > Remove null check for value that could never be null.
> > >
> > > Coverity issue: 381646, 381631
> > > Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")
> > >
> > > Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
> > > ---
> > >   drivers/baseband/acc/rte_acc100_pmd.c | 4 ----
> > >   1 file changed, 4 deletions(-)
> > >
> > > diff --git a/drivers/baseband/acc/rte_acc100_pmd.c
> > > b/drivers/baseband/acc/rte_acc100_pmd.c
> > > index 96daef87bc..30a718916d 100644
> > > --- a/drivers/baseband/acc/rte_acc100_pmd.c
> > > +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> > > @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct
> > rte_bbdev_queue_data *q_data,
> > >   	struct rte_bbdev_enc_op *op;
> > >   	union acc_dma_desc *desc;
> > >
> > > -	if (q == NULL)
> > > -		return 0;
> >
> > Can we be sure it can never be NULL?
> >
> > static inline uint16_t
> > rte_bbdev_dequeue_ldpc_enc_ops(uint16_t dev_id, uint16_t queue_id,
> > 		struct rte_bbdev_enc_op **ops, uint16_t num_ops) {
> > 	struct rte_bbdev *dev = &rte_bbdev_devices[dev_id];
> > 	struct rte_bbdev_queue_data *q_data = &dev->data-
> > >queues[queue_id];
> > 	return dev->dequeue_ldpc_enc_ops(q_data, ops, num_ops); }
> >
> > If the application passes an invalid queue_id or dev_id you can easily
> > get garbage.
> >
> > It may be worth adding some checks in all the helpers, to be sure
> > dev_id is valid, and same for queue_id. We do that in Vhost library to
> > improve robustness.
> >
> > I know there is this comment:
> > "
> >   * This function does not provide any error notification to avoid the
> >   * corresponding overhead.
> > "
> >
> > But to me this is not a good justification, the overhead would be minimal.
> >
> 
> Thanks.
> The rational is that this function needs to be very lightweight since this is a
> called in loop and hence this is was captured explicitly in bbdev.
> More generally I don’t believe that a change to bbdev would be relevant in that
> ticket, ok to move that discussion for later on in any case?
> 
> This ticket is purely about a Coverity fix for the ACC100 PMD. Note that we
> don’t check for q null during dequeue in most baseband PMD (including both
> intel and non-intel ones), this one was not required either, only historical.
> Does that sound fair in the context of that Coverity fix?
> Thanks
> Nic
> 
> 
> > Regards,
> > Maxime
> >
> > >   #ifdef RTE_LIBRTE_BBDEV_DEBUG
> > >   	if (unlikely(ops == 0))
> > >   		return 0;
> > >   #endif
> > >   	desc = q->ring_addr + (q->sw_ring_tail & q->sw_ring_wrap_mask);
> > > -	if (unlikely(desc == NULL))
> > > -		return 0;
> > >   	op = desc->req.op_addr;
> > >   	if (unlikely(ops == NULL || op == NULL))
> > >   		return 0;

Re: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[David Marchand]

On Thu, Nov 3, 2022 at 8:57 PM Hernan Vargas <hernan.vargas@intel.com> wrote:
>
> Fix potential issue of dereferencing a pointer before null check.
> Remove null check for value that could never be null.
>
> Coverity issue: 381646, 381631
> Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")
>
> Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
> ---
>  drivers/baseband/acc/rte_acc100_pmd.c | 4 ----
>  1 file changed, 4 deletions(-)
>
> diff --git a/drivers/baseband/acc/rte_acc100_pmd.c b/drivers/baseband/acc/rte_acc100_pmd.c
> index 96daef87bc..30a718916d 100644
> --- a/drivers/baseband/acc/rte_acc100_pmd.c
> +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct rte_bbdev_queue_data *q_data,
>         struct rte_bbdev_enc_op *op;
>         union acc_dma_desc *desc;
>
> -       if (q == NULL)
> -               return 0;

I guess this protects badly written applications that would do stuff
like pass an incorrect queue id, or call this callback while the queue
has not been configured yet.
This is something that should be caught at the bbdev layer (arguably
under the RTE_LIBRTE_BBDEV_DEBUG if the performance is that much
affected, though I'd like to see numbers).
(edit: I see Maxime replied a similar comment).

Back to this particular patch, rather than remove the check, the right
fix is to move acc_ring_avail_deq(q).
This is what Coverity reports.

And this same pattern is used in other parts of the driver.
It just happens that Coverity did not report them because some avec
under RTE_LIBRTE_BBDEV_DEBUG...



>  #ifdef RTE_LIBRTE_BBDEV_DEBUG
>         if (unlikely(ops == 0))

And I also noticed this hunk.

DPDK coding style, ops should be compared against NULL, but see below...


>                 return 0;
>  #endif
>         desc = q->ring_addr + (q->sw_ring_tail & q->sw_ring_wrap_mask);
> -       if (unlikely(desc == NULL))
> -               return 0;
>         op = desc->req.op_addr;
>         if (unlikely(ops == NULL || op == NULL))
>                 return 0;

... like here, so above check is redundant.

There is probably more cleanups to do in this driver.
This can be done later.


-- 
David Marchand

RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Chautru, Nicolas]

Hi David, 

> -----Original Message-----
> From: David Marchand <david.marchand@redhat.com>
> Sent: Thursday, November 10, 2022 1:49 AM
> To: Vargas, Hernan <hernan.vargas@intel.com>
> Cc: dev@dpdk.org; gakhil@marvell.com; trix@redhat.com;
> maxime.coquelin@redhat.com; Chautru, Nicolas <nicolas.chautru@intel.com>;
> Zhang, Qi Z <qi.z.zhang@intel.com>
> Subject: Re: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code
> 
> On Thu, Nov 3, 2022 at 8:57 PM Hernan Vargas <hernan.vargas@intel.com>
> wrote:
> >
> > Fix potential issue of dereferencing a pointer before null check.
> > Remove null check for value that could never be null.
> >
> > Coverity issue: 381646, 381631
> > Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")
> >
> > Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
> > ---
> >  drivers/baseband/acc/rte_acc100_pmd.c | 4 ----
> >  1 file changed, 4 deletions(-)
> >
> > diff --git a/drivers/baseband/acc/rte_acc100_pmd.c
> > b/drivers/baseband/acc/rte_acc100_pmd.c
> > index 96daef87bc..30a718916d 100644
> > --- a/drivers/baseband/acc/rte_acc100_pmd.c
> > +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> > @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct
> rte_bbdev_queue_data *q_data,
> >         struct rte_bbdev_enc_op *op;
> >         union acc_dma_desc *desc;
> >
> > -       if (q == NULL)
> > -               return 0;
> 
> I guess this protects badly written applications that would do stuff like pass an
> incorrect queue id, or call this callback while the queue has not been configured
> yet.
> This is something that should be caught at the bbdev layer (arguably under the
> RTE_LIBRTE_BBDEV_DEBUG if the performance is that much affected, though
> I'd like to see numbers).
> (edit: I see Maxime replied a similar comment).

That is not directly to that ticket but would be good to follow up. 
From previous discussion with Maxime, the new consensus was to avoid special check in debug mode (try to build the same code). It would be good to come up to a new consensus on this. 

> 
> Back to this particular patch, rather than remove the check, the right fix is to
> move acc_ring_avail_deq(q).
> This is what Coverity reports.
> 
> And this same pattern is used in other parts of the driver.
> It just happens that Coverity did not report them because some avec under
> RTE_LIBRTE_BBDEV_DEBUG...

I believe that we don't want to create discrepancies : each dequeue function should behave the same way. Ie. acc100_dequeue_ldpc_enc should not do things differently from others dequeue functions. 
Currently there is a discrepancy which is being resolved in that patch.

Either we remove the check as in that commit which could be approved as is, 
or we move the check under the debug as for the other functions which hides the Coverity issue without in reality fully addressing it, 
or we remove these check from all functions (including under debug) which is what we do for other PMD. 

That 4th option you seem to suggest would consist in effect to do thing differently just for the dequeue function which would lacks consistency really. 

Is there any concern just to approve as is, again that q == NULL is not done in production code anywhere else as you pointed out.

I agree that in next release we can remove much of the code under DEBUG flag which is not adding value nor being built/used in practice. 

Thanks
Nic

> 
> 
> 
> >  #ifdef RTE_LIBRTE_BBDEV_DEBUG
> >         if (unlikely(ops == 0))
> 
> And I also noticed this hunk.
> 
> DPDK coding style, ops should be compared against NULL, but see below...
> 
> 
> >                 return 0;
> >  #endif
> >         desc = q->ring_addr + (q->sw_ring_tail & q->sw_ring_wrap_mask);
> > -       if (unlikely(desc == NULL))
> > -               return 0;
> >         op = desc->req.op_addr;
> >         if (unlikely(ops == NULL || op == NULL))
> >                 return 0;
> 
> ... like here, so above check is redundant.
> 
> There is probably more cleanups to do in this driver.
> This can be done later.
> 
> 
> --
> David Marchand

RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Chautru, Nicolas]

David, 
Reminder on this one. Ok to apply as is?
If not consensus we cannot also mark the Coverity warning as not an issue but please check notes below. 
Thanks
Nic

> -----Original Message-----
> From: Chautru, Nicolas
> Sent: Thursday, November 10, 2022 1:15 PM
> To: David Marchand <david.marchand@redhat.com>; Vargas, Hernan
> <Hernan.Vargas@intel.com>
> Cc: dev@dpdk.org; gakhil@marvell.com; trix@redhat.com;
> maxime.coquelin@redhat.com; Zhang, Qi Z <qi.z.zhang@intel.com>
> Subject: RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead
> code
> 
> Hi David,
> 
> > -----Original Message-----
> > From: David Marchand <david.marchand@redhat.com>
> > Sent: Thursday, November 10, 2022 1:49 AM
> > To: Vargas, Hernan <hernan.vargas@intel.com>
> > Cc: dev@dpdk.org; gakhil@marvell.com; trix@redhat.com;
> > maxime.coquelin@redhat.com; Chautru, Nicolas
> > <nicolas.chautru@intel.com>; Zhang, Qi Z <qi.z.zhang@intel.com>
> > Subject: Re: [PATCH v1 1/1] baseband/acc: fix check after deref and
> > dead code
> >
> > On Thu, Nov 3, 2022 at 8:57 PM Hernan Vargas <hernan.vargas@intel.com>
> > wrote:
> > >
> > > Fix potential issue of dereferencing a pointer before null check.
> > > Remove null check for value that could never be null.
> > >
> > > Coverity issue: 381646, 381631
> > > Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")
> > >
> > > Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
> > > ---
> > >  drivers/baseband/acc/rte_acc100_pmd.c | 4 ----
> > >  1 file changed, 4 deletions(-)
> > >
> > > diff --git a/drivers/baseband/acc/rte_acc100_pmd.c
> > > b/drivers/baseband/acc/rte_acc100_pmd.c
> > > index 96daef87bc..30a718916d 100644
> > > --- a/drivers/baseband/acc/rte_acc100_pmd.c
> > > +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> > > @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct
> > rte_bbdev_queue_data *q_data,
> > >         struct rte_bbdev_enc_op *op;
> > >         union acc_dma_desc *desc;
> > >
> > > -       if (q == NULL)
> > > -               return 0;
> >
> > I guess this protects badly written applications that would do stuff
> > like pass an incorrect queue id, or call this callback while the queue
> > has not been configured yet.
> > This is something that should be caught at the bbdev layer (arguably
> > under the RTE_LIBRTE_BBDEV_DEBUG if the performance is that much
> > affected, though I'd like to see numbers).
> > (edit: I see Maxime replied a similar comment).
> 
> That is not directly to that ticket but would be good to follow up.
> From previous discussion with Maxime, the new consensus was to avoid
> special check in debug mode (try to build the same code). It would be good to
> come up to a new consensus on this.
> 
> >
> > Back to this particular patch, rather than remove the check, the right
> > fix is to move acc_ring_avail_deq(q).
> > This is what Coverity reports.
> >
> > And this same pattern is used in other parts of the driver.
> > It just happens that Coverity did not report them because some avec
> > under RTE_LIBRTE_BBDEV_DEBUG...
> 
> I believe that we don't want to create discrepancies : each dequeue function
> should behave the same way. Ie. acc100_dequeue_ldpc_enc should not do
> things differently from others dequeue functions.
> Currently there is a discrepancy which is being resolved in that patch.
> 
> Either we remove the check as in that commit which could be approved as is,
> or we move the check under the debug as for the other functions which hides
> the Coverity issue without in reality fully addressing it, or we remove these
> check from all functions (including under debug) which is what we do for
> other PMD.
> 
> That 4th option you seem to suggest would consist in effect to do thing
> differently just for the dequeue function which would lacks consistency really.
> 
> Is there any concern just to approve as is, again that q == NULL is not done in
> production code anywhere else as you pointed out.
> 
> I agree that in next release we can remove much of the code under DEBUG
> flag which is not adding value nor being built/used in practice.
> 
> Thanks
> Nic
> 
> >
> >
> >
> > >  #ifdef RTE_LIBRTE_BBDEV_DEBUG
> > >         if (unlikely(ops == 0))
> >
> > And I also noticed this hunk.
> >
> > DPDK coding style, ops should be compared against NULL, but see below...
> >
> >
> > >                 return 0;
> > >  #endif
> > >         desc = q->ring_addr + (q->sw_ring_tail & q->sw_ring_wrap_mask);
> > > -       if (unlikely(desc == NULL))
> > > -               return 0;
> > >         op = desc->req.op_addr;
> > >         if (unlikely(ops == NULL || op == NULL))
> > >                 return 0;
> >
> > ... like here, so above check is redundant.
> >
> > There is probably more cleanups to do in this driver.
> > This can be done later.
> >
> >
> > --
> > David Marchand

Re: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[David Marchand]

Hello Nicolas, Hernan,

On Thu, Nov 10, 2022 at 10:15 PM Chautru, Nicolas
<nicolas.chautru@intel.com> wrote:
> > > diff --git a/drivers/baseband/acc/rte_acc100_pmd.c
> > > b/drivers/baseband/acc/rte_acc100_pmd.c
> > > index 96daef87bc..30a718916d 100644
> > > --- a/drivers/baseband/acc/rte_acc100_pmd.c
> > > +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> > > @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct
> > rte_bbdev_queue_data *q_data,
> > >         struct rte_bbdev_enc_op *op;
> > >         union acc_dma_desc *desc;
> > >
> > > -       if (q == NULL)
> > > -               return 0;
> >
> > I guess this protects badly written applications that would do stuff like pass an
> > incorrect queue id, or call this callback while the queue has not been configured
> > yet.
> > This is something that should be caught at the bbdev layer (arguably under the
> > RTE_LIBRTE_BBDEV_DEBUG if the performance is that much affected, though
> > I'd like to see numbers).
> > (edit: I see Maxime replied a similar comment).
>
> That is not directly to that ticket but would be good to follow up.
> From previous discussion with Maxime, the new consensus was to avoid special check in debug mode (try to build the same code). It would be good to come up to a new consensus on this.

- Yes, there is something to look at in follow ups so we agree on
which checks to add and have them *consistent* for all dequeue
functions.
I am not taking sides with removing or adding checks for now.

My point above was to ask for performance numbers as part of this follow ups.
If there is concern that adding checks has a cost, we need numbers to conclude.
I saw none so far.


- Now, for this patch precisely, I still stand with this part of my
previous mail:

""
> > Back to this particular patch, rather than remove the check, the right fix is to
> > move acc_ring_avail_deq(q).
> > This is what Coverity reports.
"""

This suggestion here seems the minimal and correct fix.

Deciding on removing/adding more checks can be decided in follow up discussions.


-- 
David Marchand

RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Chautru, Nicolas]

Hi David, 
I am not sure why the push back. The minimal and proper fix is that v1. 
We are not making that check for other dequeue function. It should not have been there in the first place. 
See previous discussion. 

Thanks
Nic

> -----Original Message-----
> From: David Marchand <david.marchand@redhat.com>
> Sent: Tuesday, November 15, 2022 8:00 AM
> To: Chautru, Nicolas <nicolas.chautru@intel.com>; Vargas, Hernan
> <hernan.vargas@intel.com>
> Cc: dev@dpdk.org; gakhil@marvell.com; trix@redhat.com;
> maxime.coquelin@redhat.com; Zhang, Qi Z <qi.z.zhang@intel.com>
> Subject: Re: [PATCH v1 1/1] baseband/acc: fix check after deref and dead
> code
> 
> Hello Nicolas, Hernan,
> 
> On Thu, Nov 10, 2022 at 10:15 PM Chautru, Nicolas
> <nicolas.chautru@intel.com> wrote:
> > > > diff --git a/drivers/baseband/acc/rte_acc100_pmd.c
> > > > b/drivers/baseband/acc/rte_acc100_pmd.c
> > > > index 96daef87bc..30a718916d 100644
> > > > --- a/drivers/baseband/acc/rte_acc100_pmd.c
> > > > +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> > > > @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct
> > > rte_bbdev_queue_data *q_data,
> > > >         struct rte_bbdev_enc_op *op;
> > > >         union acc_dma_desc *desc;
> > > >
> > > > -       if (q == NULL)
> > > > -               return 0;
> > >
> > > I guess this protects badly written applications that would do stuff
> > > like pass an incorrect queue id, or call this callback while the
> > > queue has not been configured yet.
> > > This is something that should be caught at the bbdev layer (arguably
> > > under the RTE_LIBRTE_BBDEV_DEBUG if the performance is that much
> > > affected, though I'd like to see numbers).
> > > (edit: I see Maxime replied a similar comment).
> >
> > That is not directly to that ticket but would be good to follow up.
> > From previous discussion with Maxime, the new consensus was to avoid
> special check in debug mode (try to build the same code). It would be good to
> come up to a new consensus on this.
> 
> - Yes, there is something to look at in follow ups so we agree on which checks
> to add and have them *consistent* for all dequeue functions.
> I am not taking sides with removing or adding checks for now.
> 
> My point above was to ask for performance numbers as part of this follow
> ups.
> If there is concern that adding checks has a cost, we need numbers to
> conclude.
> I saw none so far.
> 
> 
> - Now, for this patch precisely, I still stand with this part of my previous mail:
> 
> ""
> > > Back to this particular patch, rather than remove the check, the
> > > right fix is to move acc_ring_avail_deq(q).
> > > This is what Coverity reports.
> """
> 
> This suggestion here seems the minimal and correct fix.
> 
> Deciding on removing/adding more checks can be decided in follow up
> discussions.
> 
> 
> --
> David Marchand

RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Chautru, Nicolas]

Hi David, 
Given we are already at RC3, let's keep the PMD as is and avoid code churn on top of lack of consensus. 
It is not worth spending more time on this for 22.11. 
I have marked the issue accordingly in Coverity, there is no concerning vulnerability just dead code which is minor and accepted. 
As mentioned we can clean up some of these checks in 23.03, hence marked as deferred. 
Thanks
Nic

> -----Original Message-----
> From: Chautru, Nicolas <nicolas.chautru@intel.com>
> Sent: Tuesday, November 15, 2022 10:04 AM
> To: David Marchand <david.marchand@redhat.com>; Vargas, Hernan
> <hernan.vargas@intel.com>
> Cc: dev@dpdk.org; gakhil@marvell.com; trix@redhat.com;
> maxime.coquelin@redhat.com; Zhang, Qi Z <qi.z.zhang@intel.com>
> Subject: RE: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code
> 
> Hi David,
> I am not sure why the push back. The minimal and proper fix is that v1.
> We are not making that check for other dequeue function. It should not have
> been there in the first place.
> See previous discussion.
> 
> Thanks
> Nic
> 
> > -----Original Message-----
> > From: David Marchand <david.marchand@redhat.com>
> > Sent: Tuesday, November 15, 2022 8:00 AM
> > To: Chautru, Nicolas <nicolas.chautru@intel.com>; Vargas, Hernan
> > <hernan.vargas@intel.com>
> > Cc: dev@dpdk.org; gakhil@marvell.com; trix@redhat.com;
> > maxime.coquelin@redhat.com; Zhang, Qi Z <qi.z.zhang@intel.com>
> > Subject: Re: [PATCH v1 1/1] baseband/acc: fix check after deref and
> > dead code
> >
> > Hello Nicolas, Hernan,
> >
> > On Thu, Nov 10, 2022 at 10:15 PM Chautru, Nicolas
> > <nicolas.chautru@intel.com> wrote:
> > > > > diff --git a/drivers/baseband/acc/rte_acc100_pmd.c
> > > > > b/drivers/baseband/acc/rte_acc100_pmd.c
> > > > > index 96daef87bc..30a718916d 100644
> > > > > --- a/drivers/baseband/acc/rte_acc100_pmd.c
> > > > > +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> > > > > @@ -4122,15 +4122,11 @@ acc100_dequeue_ldpc_enc(struct
> > > > rte_bbdev_queue_data *q_data,
> > > > >         struct rte_bbdev_enc_op *op;
> > > > >         union acc_dma_desc *desc;
> > > > >
> > > > > -       if (q == NULL)
> > > > > -               return 0;
> > > >
> > > > I guess this protects badly written applications that would do
> > > > stuff like pass an incorrect queue id, or call this callback while
> > > > the queue has not been configured yet.
> > > > This is something that should be caught at the bbdev layer
> > > > (arguably under the RTE_LIBRTE_BBDEV_DEBUG if the performance is
> > > > that much affected, though I'd like to see numbers).
> > > > (edit: I see Maxime replied a similar comment).
> > >
> > > That is not directly to that ticket but would be good to follow up.
> > > From previous discussion with Maxime, the new consensus was to avoid
> > special check in debug mode (try to build the same code). It would be
> > good to come up to a new consensus on this.
> >
> > - Yes, there is something to look at in follow ups so we agree on
> > which checks to add and have them *consistent* for all dequeue functions.
> > I am not taking sides with removing or adding checks for now.
> >
> > My point above was to ask for performance numbers as part of this
> > follow ups.
> > If there is concern that adding checks has a cost, we need numbers to
> > conclude.
> > I saw none so far.
> >
> >
> > - Now, for this patch precisely, I still stand with this part of my previous
> mail:
> >
> > ""
> > > > Back to this particular patch, rather than remove the check, the
> > > > right fix is to move acc_ring_avail_deq(q).
> > > > This is what Coverity reports.
> > """
> >
> > This suggestion here seems the minimal and correct fix.
> >
> > Deciding on removing/adding more checks can be decided in follow up
> > discussions.
> >
> >
> > --
> > David Marchand

[PATCH v1 0/1] DPDK Coverity issue 381631, 381646

[Hernan Vargas]

Upstream fix to 23.03 for potential issue of dereferencing a pointer before null check.

Hernan Vargas (1):
  baseband/acc: fix check after deref and dead code

 drivers/baseband/acc/rte_acc100_pmd.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

-- 
2.37.1

[PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Hernan Vargas]

Fix potential issue of dereferencing a pointer before null check.
Remove null check for value that could never be null.

Coverity issue: 381646, 381631
Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")

Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
---
 drivers/baseband/acc/rte_acc100_pmd.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/drivers/baseband/acc/rte_acc100_pmd.c b/drivers/baseband/acc/rte_acc100_pmd.c
index 0992cb5d1e..a600511f4b 100644
--- a/drivers/baseband/acc/rte_acc100_pmd.c
+++ b/drivers/baseband/acc/rte_acc100_pmd.c
@@ -4106,12 +4106,9 @@ acc100_dequeue_ldpc_enc(struct rte_bbdev_queue_data *q_data,
 	int ret, cbm;
 	struct rte_bbdev_enc_op *op;
 
-	if (q == NULL)
-		return 0;
-#ifdef RTE_LIBRTE_BBDEV_DEBUG
-	if (unlikely(ops == 0))
+	if (avail == 0)
 		return 0;
-#endif
+
 	op = acc_op_tail(q, 0);
 	if (unlikely(ops == NULL || op == NULL))
 		return 0;
-- 
2.37.1

Re: [PATCH v1 1/1] baseband/acc: fix check after deref and dead code

[Maxime Coquelin]

On 1/20/23 21:55, Hernan Vargas wrote:
> Fix potential issue of dereferencing a pointer before null check.
> Remove null check for value that could never be null.
> 
> Coverity issue: 381646, 381631
> Fixes: 989dec301a9 ("baseband/acc100: add ring companion address")

Please Cc stable, since it fixes a patch merged in v22.11.

> 
> Signed-off-by: Hernan Vargas <hernan.vargas@intel.com>
> ---
>   drivers/baseband/acc/rte_acc100_pmd.c | 7 ++-----
>   1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/baseband/acc/rte_acc100_pmd.c b/drivers/baseband/acc/rte_acc100_pmd.c
> index 0992cb5d1e..a600511f4b 100644
> --- a/drivers/baseband/acc/rte_acc100_pmd.c
> +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> @@ -4106,12 +4106,9 @@ acc100_dequeue_ldpc_enc(struct rte_bbdev_queue_data *q_data,
>   	int ret, cbm;
>   	struct rte_bbdev_enc_op *op;
>   
> -	if (q == NULL)
> -		return 0;
> -#ifdef RTE_LIBRTE_BBDEV_DEBUG
> -	if (unlikely(ops == 0))
> +	if (avail == 0)

Introduction of this new check on avail is not explained in the commit 
message, it does not seem related to the purpose of this patch.

It looks like an optimization, so should be in a separate patch.

>   		return 0;
> -#endif
> +
>   	op = acc_op_tail(q, 0);
>   	if (unlikely(ops == NULL || op == NULL))
>   		return 0;