* [Bug 1146] bnx2x: rte_memcpy buffer overflows
@ 2022-12-09 18:35 bugzilla
2024-03-18 0:49 ` [DPDK/ethdev Bug " bugzilla
0 siblings, 1 reply; 2+ messages in thread
From: bugzilla @ 2022-12-09 18:35 UTC (permalink / raw)
To: dev
https://bugs.dpdk.org/show_bug.cgi?id=1146
Bug ID: 1146
Summary: bnx2x: rte_memcpy buffer overflows
Product: DPDK
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: ethdev
Assignee: dev@dpdk.org
Reporter: mb@smartsharesystems.com
Target Milestone: ---
Test-Label: Intel-compilation
Test-Status: FAILURE
http://dpdk.org/patch/120440
_Compilation issues_
Submitter: Morten Brørup <mb@smartsharesystems.com>
Date: 2022-12-03 14:22:44
Reply_mail: <20221203142244.17135-1-mb@smartsharesystems.com>
DPDK git baseline: Repo:dpdk, CommitID:
6c8aed5ab7f6dbed8e71199504fa227f5f60c6fd
Meson Build Summary: 26 Builds Done, 23 Successful, 3 Failures, 0 Blocked
+--------------+------------+--------------+------------+------------+-----------+----------+------------+
| os | gcc-static | clang-static | icc-static | gcc-shared |
gcc-debug | document | gcc-16byte |
+--------------+------------+--------------+------------+------------+-----------+----------+------------+
| FC36-64 | fail | pass | | |
| | |
| FreeBSD13-64 | pass | pass | | pass | pass
| | |
| RHEL86-64 | pass | pass | | pass | pass
| | |
| SUSE15-64 | pass | pass | | |
| | |
| RHEL90-64 | pass | | | |
| | |
| UB2004-64 | pass | pass | | |
| pass | |
| UB2204-32 | pass | | | |
| | |
| UB2204-64 | pass | pass | | |
| pass | pass |
| CentOS79-64 | pass | | | |
| | |
| RHEL86-64Rt | pass | pass | | |
| | |
| UB2210-64 | fail | | | |
| | |
| FC37-64 | fail | | | |
| | |
+--------------+------------+--------------+------------+------------+-----------+----------+------------+
Comments:
Because of DPDK bug (https://bugs.dpdk.org/show_bug.cgi?id=928),
All the dpdk-next-* branch add `Ddisable_drivers=event/cnxk` option when build
with ICC complier.
Test environment and configuration as below:
OS: FC36-64
Kernel Version: 5.17.7-300.fc36.x86_64
GCC Version: gcc (GCC) 12.1.1 20220507 (Red Hat 12.1.1-1)
Clang Version: 14.0.0 (Fedora 14.0.0-1.fc36)
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-clang
OS: FreeBSD13-64
Kernel Version: 13.1-RELEASE
GCC Version: gcc (FreeBSD Ports Collection) 10.3.0
Clang Version: 13.0.0 (git@github.com:llvm/llvm-project.git
llvmorg-13.0.0-0-gd7b669b3a303)
x86_64-native-bsdapp-gcc
x86_64-native-bsdapp-clang
x86_64-native-bsdapp-gcc+shared
x86_64-native-bsdapp-gcc+debug
OS: RHEL86-64
Kernel Version: 4.18.0-372.9.1.el8.x86_64
GCC Version: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-13)
Clang Version: 14.0.0 (Red Hat 14.0.0-1.module_el8.7.0+1142+5343df54)
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-clang
x86_64-native-linuxapp-gcc+shared
x86_64-native-linuxapp-gcc+debug
OS: SUSE15-64
Kernel Version: 5.14.21-150400.22-default
GCC Version: gcc (SUSE Linux) 7.5.0
Clang Version: 11.0.1
x86_64-native-linuxapp-clang
x86_64-native-linuxapp-gcc
OS: RHEL90-64
Kernel Version: 5.14.0-70.13.1.el9_0.x86_64
GCC Version: gcc (GCC) 11.2.1 20220127 (Red Hat 11.2.1-9)
Clang Version: 13.0.1 (Red Hat 13.0.1-1.el9)
x86_64-native-linuxapp-gcc
OS: UB2004-64
Kernel Version: 5.8.0-48-generic
GCC Version: gcc (Ubuntu 10.3.0-1ubuntu1~20.04) 10.3.0
Clang Version: 10.0.0-4ubuntu1
x86_64-native-linuxapp-clang
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-doc
OS: UB2204-32
Kernel Version: 5.15.0-25-generic
GCC Version: gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0
Clang Version: NA
i686-native-linuxapp-gcc
OS: UB2204-64
Kernel Version: 5.15.0-25-generic
GCC Version: gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0
Clang Version: 14.0.0-1ubuntu1
x86_64-native-linuxapp-gcc+16byte
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-clang
x86_64-native-linuxapp-doc
OS: CentOS79-64
Kernel Version: 3.10.0-1160.76.1.el7.x86_64
GCC Version: gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-44)
Clang Version: 3.4.2 (tags/RELEASE_34/dot2-final)
x86_64-native-linuxapp-gcc
OS: RHEL86-64Rt
Kernel Version: 4.18.0-372.9.1.rt7.166.el8.x86_64
GCC Version: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-13)
Clang Version: 14.0.0 (Red Hat 14.0.0-1.module_el8.7.0+1142+5343df54)
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-clang
OS: UB2210-64
Kernel Version: 5.19.0-21-generic
GCC Version: gcc (Ubuntu 12.2.0-3ubuntu1) 12.2.0
Clang Version: 15.0.2-1
x86_64-native-linuxapp-gcc
OS: FC37-64
Kernel Version: 6.0.7-301.fc37.x86_64
GCC Version: gcc (GCC) 12.2.1 20220819 (Red Hat 12.2.1-2)
Clang Version: 15.0.4 (Fedora 15.0.4-1.fc37)
x86_64-native-linuxapp-gcc
*Build Failed #1:
OS: FC36-64
Target: x86_64-native-linuxapp-gcc
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -c
../drivers/net/bnx2x/bnx2x_vfpf.c
../drivers/net/bnx2x/bnx2x_vfpf.c: In function ‘bnx2x_check_bull’:
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ writing 4 bytes
into a region of size 2 overflows the destination [-Werror=stringop-overflow=]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:29,
from ../drivers/net/bnx2x/bnx2x_vfpf.c:8:
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: destination object ‘vlan’ of
size 2
297 | uint16_t vlan;
| ^~~~
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ reading 4 bytes
from a region of size 2 [-Werror=stringop-overread]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: source object ‘vlan’ of size 2
297 | uint16_t vlan;
| ^~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[975/3225] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_filter.c.o
[976/3225] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_cpr.c.o
[977/3225] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_ecore_sp.c.o
[978/3225] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -c
../drivers/net/bnx2x/bnx2x_stats.c
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_hw_stats_update’:
../drivers/net/bnx2x/bnx2x_stats.c:822:5: error: ‘rte_memcpy’ writing 304 bytes
into a region of size 4 overflows the destination [-Werror=stringop-overflow=]
822 | rte_memcpy(&(estats->rx_stat_ifhcinbadoctets_hi),
&(pstats->mac_stx[1]),
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
823 | sizeof(struct mac_stx));
| ~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:28,
from ../drivers/net/bnx2x/bnx2x_stats.c:14:
../drivers/net/bnx2x/bnx2x_stats.h:82:14: note: destination object
‘rx_stat_ifhcinbadoctets_hi’ of size 4
82 | uint32_t rx_stat_ifhcinbadoctets_hi;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_stats_init’:
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1494:17: note: in expansion of macro
‘REG_RD_DMAE’
1494 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT0 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:34:14: note: destination object
‘egress_mac_pkt0_lo’ of size 4
34 | uint32_t egress_mac_pkt0_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1496:17: note: in expansion of macro
‘REG_RD_DMAE’
1496 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT1 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:36:14: note: destination object
‘egress_mac_pkt1_lo’ of size 4
36 | uint32_t egress_mac_pkt1_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[979/3225] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_ethdev.c.o
[980/3225] Generating drivers/rte_common_sfc_efx.sym_chk with a custom command
(wrapped by meson to capture output)
[981/3225] Generating drivers/rte_common_cnxk.sym_chk with a custom command
(wrapped by meson to capture output)
[982/3225] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x.c.o
[983/3225] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_elink.c.o
ninja: build stopped
*Build Failed #2:
OS: UB2210-64
Target: x86_64-native-linuxapp-gcc
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -c
../drivers/net/bnx2x/bnx2x_vfpf.c
../drivers/net/bnx2x/bnx2x_vfpf.c: In function ‘bnx2x_check_bull’:
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ writing 4 bytes
into a region of size 2 overflows the destination [-Werror=stringop-overflow=]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:29,
from ../drivers/net/bnx2x/bnx2x_vfpf.c:8:
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: destination object ‘vlan’ of
size 2
297 | uint16_t vlan;
| ^~~~
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ reading 4 bytes
from a region of size 2 [-Werror=stringop-overread]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: source object ‘vlan’ of size 2
297 | uint16_t vlan;
| ^~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[965/3242] Generating drivers/rte_net_axgbe.pmd.c with a custom command
[966/3242] Generating drivers/rte_common_sfc_efx.sym_chk with a custom command
(wrapped by meson to capture output)
[967/3242] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_cpr.c.o
[968/3242] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_filter.c.o
[969/3242] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -c
../drivers/net/bnx2x/bnx2x_stats.c
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_hw_stats_update’:
../drivers/net/bnx2x/bnx2x_stats.c:822:5: error: ‘rte_memcpy’ writing 304 bytes
into a region of size 4 overflows the destination [-Werror=stringop-overflow=]
822 | rte_memcpy(&(estats->rx_stat_ifhcinbadoctets_hi),
&(pstats->mac_stx[1]),
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
823 | sizeof(struct mac_stx));
| ~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:28,
from ../drivers/net/bnx2x/bnx2x_stats.c:14:
../drivers/net/bnx2x/bnx2x_stats.h:82:14: note: destination object
‘rx_stat_ifhcinbadoctets_hi’ of size 4
82 | uint32_t rx_stat_ifhcinbadoctets_hi;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_stats_init’:
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1494:17: note: in expansion of macro
‘REG_RD_DMAE’
1494 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT0 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:34:14: note: destination object
‘egress_mac_pkt0_lo’ of size 4
34 | uint32_t egress_mac_pkt0_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1496:17: note: in expansion of macro
‘REG_RD_DMAE’
1496 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT1 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:36:14: note: destination object
‘egress_mac_pkt1_lo’ of size 4
36 | uint32_t egress_mac_pkt1_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[970/3242] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_ecore_sp.c.o
[971/3242] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_ethdev.c.o
[972/3242] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x.c.o
[973/3242] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_elink.c.o
ninja: build stopped
*Build Failed #3:
OS: FC37-64
Target: x86_64-native-linuxapp-gcc
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -c
../drivers/net/bnx2x/bnx2x_vfpf.c
../drivers/net/bnx2x/bnx2x_vfpf.c: In function ‘bnx2x_check_bull’:
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ writing 4 bytes
into a region of size 2 overflows the destination [-Werror=stringop-overflow=]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:29,
from ../drivers/net/bnx2x/bnx2x_vfpf.c:8:
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: destination object ‘vlan’ of
size 2
297 | uint16_t vlan;
| ^~~~
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ reading 4 bytes
from a region of size 2 [-Werror=stringop-overread]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: source object ‘vlan’ of size 2
297 | uint16_t vlan;
| ^~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[974/3192] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_filter.c.o
[975/3192] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -c
../drivers/net/bnx2x/bnx2x_stats.c
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_hw_stats_update’:
../drivers/net/bnx2x/bnx2x_stats.c:822:5: error: ‘rte_memcpy’ writing 304 bytes
into a region of size 4 overflows the destination [-Werror=stringop-overflow=]
822 | rte_memcpy(&(estats->rx_stat_ifhcinbadoctets_hi),
&(pstats->mac_stx[1]),
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
823 | sizeof(struct mac_stx));
| ~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:28,
from ../drivers/net/bnx2x/bnx2x_stats.c:14:
../drivers/net/bnx2x/bnx2x_stats.h:82:14: note: destination object
‘rx_stat_ifhcinbadoctets_hi’ of size 4
82 | uint32_t rx_stat_ifhcinbadoctets_hi;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_stats_init’:
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1494:17: note: in expansion of macro
‘REG_RD_DMAE’
1494 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT0 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:34:14: note: destination object
‘egress_mac_pkt0_lo’ of size 4
34 | uint32_t egress_mac_pkt0_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1496:17: note: in expansion of macro
‘REG_RD_DMAE’
1496 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT1 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:36:14: note: destination object
‘egress_mac_pkt1_lo’ of size 4
36 | uint32_t egress_mac_pkt1_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[976/3192] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_rxq.c.o
[977/3192] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_ecore_sp.c.o
[978/3192] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_ethdev.c.o
[979/3192] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x.c.o
[980/3192] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_elink.c.o
[981/3192] Generating drivers/rte_common_sfc_efx.sym_chk with a custom command
(wrapped by meson to capture output)
[982/3192] Generating drivers/rte_common_cnxk.sym_chk with a custom command
(wrapped by meson to capture output)
ninja: build stopped
DPDK STV team
--
You are receiving this mail because:
You are the assignee for the bug.
^ permalink raw reply [flat|nested] 2+ messages in thread
* [DPDK/ethdev Bug 1146] bnx2x: rte_memcpy buffer overflows
2022-12-09 18:35 [Bug 1146] bnx2x: rte_memcpy buffer overflows bugzilla
@ 2024-03-18 0:49 ` bugzilla
0 siblings, 0 replies; 2+ messages in thread
From: bugzilla @ 2024-03-18 0:49 UTC (permalink / raw)
To: dev
[-- Attachment #1: Type: text/plain, Size: 548 bytes --]
https://bugs.dpdk.org/show_bug.cgi?id=1146
Thomas Monjalon (thomas@monjalon.net) changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|UNCONFIRMED |RESOLVED
--- Comment #2 from Thomas Monjalon (thomas@monjalon.net) ---
Resolved in http://git.dpdk.org/dpdk/commit/?id=c50b86f7d6
--
You are receiving this mail because:
You are the assignee for the bug.
[-- Attachment #2: Type: text/html, Size: 2571 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-03-18 0:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-09 18:35 [Bug 1146] bnx2x: rte_memcpy buffer overflows bugzilla
2024-03-18 0:49 ` [DPDK/ethdev Bug " bugzilla
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).