From: Ajit Khaparde <ajit.khaparde@broadcom.com>
To: dev@dpdk.org
Cc: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
Subject: [PATCH 08/14] net/bnxt: fix array overflow
Date: Mon, 4 Dec 2023 10:37:04 -0800 [thread overview]
Message-ID: <20231204183710.86921-9-ajit.khaparde@broadcom.com> (raw)
In-Reply-To: <20231204183710.86921-1-ajit.khaparde@broadcom.com>
[-- Attachment #1: Type: text/plain, Size: 4523 bytes --]
In some cases the number of elements in the context memory array
can exceed the MAX_CTX_PAGES and that can cause the static members
ctx_pg_arr and ctx_dma_arr to overflow.
Allocate them dynamically to prevent this overflow.
Signed-off-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Reviewed-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
---
drivers/net/bnxt/bnxt.h | 4 ++--
drivers/net/bnxt/bnxt_ethdev.c | 42 +++++++++++++++++++++++++++-------
2 files changed, 36 insertions(+), 10 deletions(-)
diff --git a/drivers/net/bnxt/bnxt.h b/drivers/net/bnxt/bnxt.h
index 7439ecf4fa..3fbdf1ddcc 100644
--- a/drivers/net/bnxt/bnxt.h
+++ b/drivers/net/bnxt/bnxt.h
@@ -455,8 +455,8 @@ struct bnxt_ring_mem_info {
struct bnxt_ctx_pg_info {
uint32_t entries;
- void *ctx_pg_arr[MAX_CTX_PAGES];
- rte_iova_t ctx_dma_arr[MAX_CTX_PAGES];
+ void **ctx_pg_arr;
+ rte_iova_t *ctx_dma_arr;
struct bnxt_ring_mem_info ring_mem;
};
diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index cab2589cf3..1eab8d5020 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -4768,7 +4768,7 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp,
{
struct bnxt_ring_mem_info *rmem = &ctx_pg->ring_mem;
const struct rte_memzone *mz = NULL;
- char mz_name[RTE_MEMZONE_NAMESIZE];
+ char name[RTE_MEMZONE_NAMESIZE];
rte_iova_t mz_phys_addr;
uint64_t valid_bits = 0;
uint32_t sz;
@@ -4780,6 +4780,19 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp,
rmem->nr_pages = RTE_ALIGN_MUL_CEIL(mem_size, BNXT_PAGE_SIZE) /
BNXT_PAGE_SIZE;
rmem->page_size = BNXT_PAGE_SIZE;
+
+ snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_pg_arr%s_%x_%d",
+ suffix, idx, bp->eth_dev->data->port_id);
+ ctx_pg->ctx_pg_arr = rte_zmalloc(name, sizeof(void *) * rmem->nr_pages, 0);
+ if (ctx_pg->ctx_pg_arr == NULL)
+ return -ENOMEM;
+
+ snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_dma_arr%s_%x_%d",
+ suffix, idx, bp->eth_dev->data->port_id);
+ ctx_pg->ctx_dma_arr = rte_zmalloc(name, sizeof(rte_iova_t *) * rmem->nr_pages, 0);
+ if (ctx_pg->ctx_dma_arr == NULL)
+ return -ENOMEM;
+
rmem->pg_arr = ctx_pg->ctx_pg_arr;
rmem->dma_arr = ctx_pg->ctx_dma_arr;
rmem->flags = BNXT_RMEM_VALID_PTE_FLAG;
@@ -4787,13 +4800,13 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp,
valid_bits = PTU_PTE_VALID;
if (rmem->nr_pages > 1) {
- snprintf(mz_name, RTE_MEMZONE_NAMESIZE,
+ snprintf(name, RTE_MEMZONE_NAMESIZE,
"bnxt_ctx_pg_tbl%s_%x_%d",
suffix, idx, bp->eth_dev->data->port_id);
- mz_name[RTE_MEMZONE_NAMESIZE - 1] = 0;
- mz = rte_memzone_lookup(mz_name);
+ name[RTE_MEMZONE_NAMESIZE - 1] = 0;
+ mz = rte_memzone_lookup(name);
if (!mz) {
- mz = rte_memzone_reserve_aligned(mz_name,
+ mz = rte_memzone_reserve_aligned(name,
rmem->nr_pages * 8,
bp->eth_dev->device->numa_node,
RTE_MEMZONE_2MB |
@@ -4812,11 +4825,11 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp,
rmem->pg_tbl_mz = mz;
}
- snprintf(mz_name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_%s_%x_%d",
+ snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_%s_%x_%d",
suffix, idx, bp->eth_dev->data->port_id);
- mz = rte_memzone_lookup(mz_name);
+ mz = rte_memzone_lookup(name);
if (!mz) {
- mz = rte_memzone_reserve_aligned(mz_name,
+ mz = rte_memzone_reserve_aligned(name,
mem_size,
bp->eth_dev->device->numa_node,
RTE_MEMZONE_1GB |
@@ -4862,6 +4875,17 @@ static void bnxt_free_ctx_mem(struct bnxt *bp)
return;
bp->ctx->flags &= ~BNXT_CTX_FLAG_INITED;
+ rte_free(bp->ctx->qp_mem.ctx_pg_arr);
+ rte_free(bp->ctx->srq_mem.ctx_pg_arr);
+ rte_free(bp->ctx->cq_mem.ctx_pg_arr);
+ rte_free(bp->ctx->vnic_mem.ctx_pg_arr);
+ rte_free(bp->ctx->stat_mem.ctx_pg_arr);
+ rte_free(bp->ctx->qp_mem.ctx_dma_arr);
+ rte_free(bp->ctx->srq_mem.ctx_dma_arr);
+ rte_free(bp->ctx->cq_mem.ctx_dma_arr);
+ rte_free(bp->ctx->vnic_mem.ctx_dma_arr);
+ rte_free(bp->ctx->stat_mem.ctx_dma_arr);
+
rte_memzone_free(bp->ctx->qp_mem.ring_mem.mz);
rte_memzone_free(bp->ctx->srq_mem.ring_mem.mz);
rte_memzone_free(bp->ctx->cq_mem.ring_mem.mz);
@@ -4874,6 +4898,8 @@ static void bnxt_free_ctx_mem(struct bnxt *bp)
rte_memzone_free(bp->ctx->stat_mem.ring_mem.pg_tbl_mz);
for (i = 0; i < bp->ctx->tqm_fp_rings_count + 1; i++) {
+ rte_free(bp->ctx->tqm_mem[i]->ctx_pg_arr);
+ rte_free(bp->ctx->tqm_mem[i]->ctx_dma_arr);
if (bp->ctx->tqm_mem[i])
rte_memzone_free(bp->ctx->tqm_mem[i]->ring_mem.mz);
}
--
2.39.2 (Apple Git-143)
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4218 bytes --]
next prev parent reply other threads:[~2023-12-04 18:38 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-04 18:36 [PATCH 00/14] support new 5760X P7 devices Ajit Khaparde
2023-12-04 18:36 ` [PATCH 01/14] net/bnxt: refactor epoch setting Ajit Khaparde
2023-12-04 18:36 ` [PATCH 02/14] net/bnxt: update HWRM API Ajit Khaparde
2023-12-04 18:36 ` [PATCH 03/14] net/bnxt: log a message when multicast promisc mode changes Ajit Khaparde
2023-12-04 18:37 ` [PATCH 04/14] net/bnxt: use the correct COS queue for Tx Ajit Khaparde
2023-12-04 18:37 ` [PATCH 05/14] net/bnxt: refactor mem zone allocation Ajit Khaparde
2023-12-04 18:37 ` [PATCH 06/14] net/bnxt: add support for p7 device family Ajit Khaparde
2023-12-04 18:37 ` [PATCH 07/14] net/bnxt: refactor code to support P7 devices Ajit Khaparde
2023-12-04 18:37 ` Ajit Khaparde [this message]
2023-12-04 18:37 ` [PATCH 09/14] net/bnxt: add support for backing store v2 Ajit Khaparde
2023-12-04 18:37 ` [PATCH 10/14] net/bnxt: refactor the ulp initialization Ajit Khaparde
2023-12-04 18:37 ` [PATCH 11/14] net/bnxt: modify sending new HWRM commands to firmware Ajit Khaparde
2023-12-04 18:37 ` [PATCH 12/14] net/bnxt: retry HWRM ver get if the command fails Ajit Khaparde
2023-12-04 18:37 ` [PATCH 13/14] net/bnxt: cap ring resources for P7 devices Ajit Khaparde
2023-12-04 18:37 ` [PATCH 14/14] net/bnxt: add support for v3 Rx completion Ajit Khaparde
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231204183710.86921-9-ajit.khaparde@broadcom.com \
--to=ajit.khaparde@broadcom.com \
--cc=damodharam.ammepalli@broadcom.com \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).