DPDK patches and discussions
 help / color / mirror / Atom feed
From: "Zhang, Tianfei" <tianfei.zhang@intel.com>
To: Aaron Conole <aconole@redhat.com>,
	"Yigit, Ferruh" <ferruh.yigit@intel.com>
Cc: David Marchand <david.marchand@redhat.com>,
	"stable@dpdk.org" <stable@dpdk.org>,
	"Huang, Wei" <wei.huang@intel.com>,
	"Zhang, Qi Z" <qi.z.zhang@intel.com>,
	"Xu, Rosen" <rosen.xu@intel.com>, "dev@dpdk.org" <dev@dpdk.org>,
	"Mcnamara, John" <john.mcnamara@intel.com>
Subject: Re: [dpdk-dev] [PATCH v2 1/1] raw/ifpga/base: check size before assigning
Date: Wed, 14 Apr 2021 02:46:21 +0000	[thread overview]
Message-ID: <DM6PR11MB313191AD69032D8CFE5AB2D8E34E9@DM6PR11MB3131.namprd11.prod.outlook.com> (raw)
In-Reply-To: <f7tk0pbjylu.fsf@dhcp-25.97.bos.redhat.com>



> -----Original Message-----
> From: Aaron Conole <aconole@redhat.com>
> Sent: 2021年4月9日 22:56
> To: Yigit, Ferruh <ferruh.yigit@intel.com>
> Cc: David Marchand <david.marchand@redhat.com>; stable@dpdk.org;
> Zhang, Tianfei <tianfei.zhang@intel.com>; Huang, Wei
> <wei.huang@intel.com>; Zhang, Qi Z <qi.z.zhang@intel.com>; Xu, Rosen
> <rosen.xu@intel.com>; dev@dpdk.org; Mcnamara, John
> <john.mcnamara@intel.com>
> Subject: Re: [PATCH v2 1/1] raw/ifpga/base: check size before assigning
> 
> Ferruh Yigit <ferruh.yigit@intel.com> writes:
> 
> > On 4/8/2021 9:51 AM, Wei Huang wrote:
> >> In max10_staging_area_init(), variable "size" from fdt_get_reg() may
> >> be invalid, it should be checked before assigning to member variable
> >> "staging_area_size" of structure "intel_max10_device".
> >>
> >> Coverity issue: 367480, 367482
> >> Fixes: 96ebfcf8125c ("raw/ifpga/base: add SPI and MAX10 device
> >> driver")
> >>
> >> Signed-off-by: Wei Huang <wei.huang@intel.com>
> >> ---
> >> v2: check size before assigning to staging_area_size
> >> ---
> >>   drivers/raw/ifpga/base/opae_intel_max10.c | 2 +-
> >>   drivers/raw/ifpga/base/opae_intel_max10.h | 1 +
> >>   2 files changed, 2 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/raw/ifpga/base/opae_intel_max10.c
> >> b/drivers/raw/ifpga/base/opae_intel_max10.c
> >> index 443e248fb3..c223fafa03 100644
> >> --- a/drivers/raw/ifpga/base/opae_intel_max10.c
> >> +++ b/drivers/raw/ifpga/base/opae_intel_max10.c
> >> @@ -593,7 +593,7 @@ static int max10_staging_area_init(struct
> intel_max10_device *dev)
> >>   			continue;
> >>     		ret = fdt_get_reg(fdt_root, offset, 0, &start, &size);
> >> -		if (!ret) {
> >> +		if (!ret && (size <= MAX_STAGING_AREA_SIZE)) {
> >>   			dev->staging_area_base = start;
> >>   			dev->staging_area_size = size;
> >>   		}
> >> diff --git a/drivers/raw/ifpga/base/opae_intel_max10.h
> >> b/drivers/raw/ifpga/base/opae_intel_max10.h
> >> index 670683f017..e7142d6f0d 100644
> >> --- a/drivers/raw/ifpga/base/opae_intel_max10.h
> >> +++ b/drivers/raw/ifpga/base/opae_intel_max10.h
> >> @@ -182,6 +182,7 @@ struct opae_retimer_status {
> >>   #define   SBUS_VERSION			GENMASK(31, 16)
> >>     #define DFT_MAX_SIZE		0x7e0000
> >> +#define MAX_STAGING_AREA_SIZE	0x3800000
> >>     int max10_reg_read(struct intel_max10_device *dev,
> >>   	unsigned int reg, unsigned int *val);
> >>
> >
> > Hi Aaron, David,
> >
> > The data flow is complex for this coverity issues [1], at least I
> > can't confirm that change fixes the issue.
> >
> > Are you aware of any way to confirm this coverity issue before merging it?
> 
> Not generically.  :-/
> 
> We need someone that understands the data flow and the coverity splat to
> know that the fix is correct.  Coverity even ratelimits how many outstanding
> submissions we can post, iirc, so we don't get to push patch sets (unless we
> pay?  I don't recall if there's an option for that).

This fix is looks good for me. The fdt_get_reg() function just read out the content of some items from DTS file,
We call the libfdt library API to do this.
The Coverity just assume some attacker broken the DTS file or invoke the function with arbitrary values, it is not safety,
So this patch add some checking after the function return.

> 
> > [1]
> > https://scan4.coverity.com/reports.htm#v26325/p10075/fileInstanceId=10
> > 0181086&defectInstanceId=14238477&mergedDefectId=367480


  reply	other threads:[~2021-04-14  2:46 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-08  8:51 [dpdk-dev] [PATCH v2 0/1] Fix coverity issues reported in DPDK-26381 Wei Huang
2021-04-08  8:51 ` [dpdk-dev] [PATCH v2 1/1] raw/ifpga/base: check size before assigning Wei Huang
2021-04-08  9:38   ` Ferruh Yigit
2021-04-09 14:56     ` Aaron Conole
2021-04-14  2:46       ` Zhang, Tianfei [this message]
2021-04-14  7:42         ` Ferruh Yigit
2021-04-16  2:49           ` Huang, Wei
2021-05-17  8:50         ` Ferruh Yigit
2021-04-19  8:12   ` Zhang, Qi Z
2021-04-19 22:35     ` Ferruh Yigit
2021-04-20  0:13       ` Zhang, Tianfei
2021-04-20  1:00         ` Ferruh Yigit
2021-04-20  1:59           ` Xu, Rosen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=DM6PR11MB313191AD69032D8CFE5AB2D8E34E9@DM6PR11MB3131.namprd11.prod.outlook.com \
    --to=tianfei.zhang@intel.com \
    --cc=aconole@redhat.com \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    --cc=ferruh.yigit@intel.com \
    --cc=john.mcnamara@intel.com \
    --cc=qi.z.zhang@intel.com \
    --cc=rosen.xu@intel.com \
    --cc=stable@dpdk.org \
    --cc=wei.huang@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).