From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by dpdk.space (Postfix) with ESMTP id 876BBA05D3 for ; Thu, 23 May 2019 07:20:37 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 098EA2B9E; Thu, 23 May 2019 07:20:37 +0200 (CEST) Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by dpdk.org (Postfix) with ESMTP id 3577B4C99; Thu, 23 May 2019 07:20:34 +0200 (CEST) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 22 May 2019 22:20:31 -0700 X-ExtLoop1: 1 Received: from fmsmsx104.amr.corp.intel.com ([10.18.124.202]) by orsmga008.jf.intel.com with ESMTP; 22 May 2019 22:20:31 -0700 Received: from shsmsx106.ccr.corp.intel.com (10.239.4.159) by fmsmsx104.amr.corp.intel.com (10.18.124.202) with Microsoft SMTP Server (TLS) id 14.3.408.0; Wed, 22 May 2019 22:20:30 -0700 Received: from shsmsx104.ccr.corp.intel.com ([169.254.5.33]) by SHSMSX106.ccr.corp.intel.com ([169.254.10.213]) with mapi id 14.03.0415.000; Thu, 23 May 2019 13:20:28 +0800 From: "Xu, Rosen" To: "Pei, Andy" , "dev@dpdk.org" CC: "stable@dpdk.org" Thread-Topic: [PATCH] net/ipn3ke: fix null pointer dereference Thread-Index: AQHVESE+LDzbBdDFvEmX2V1YhOeXzKZ4LCtQ Date: Thu, 23 May 2019 05:20:28 +0000 Message-ID: <0E78D399C70DA940A335608C6ED296D73A76EE97@SHSMSX104.ccr.corp.intel.com> References: <1558585882-222368-1-git-send-email-andy.pei@intel.com> In-Reply-To: <1558585882-222368-1-git-send-email-andy.pei@intel.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-titus-metadata-40: eyJDYXRlZ29yeUxhYmVscyI6IiIsIk1ldGFkYXRhIjp7Im5zIjoiaHR0cDpcL1wvd3d3LnRpdHVzLmNvbVwvbnNcL0ludGVsMyIsImlkIjoiNzUwOTI4NGQtYmY3My00ZDUyLTg2MzEtNTE0N2E2ZDU0NjA5IiwicHJvcHMiOlt7Im4iOiJDVFBDbGFzc2lmaWNhdGlvbiIsInZhbHMiOlt7InZhbHVlIjoiQ1RQX05UIn1dfV19LCJTdWJqZWN0TGFiZWxzIjpbXSwiVE1DVmVyc2lvbiI6IjE3LjEwLjE4MDQuNDkiLCJUcnVzdGVkTGFiZWxIYXNoIjoiMHFURnJmRDBTTThwdWRQRFNMdWRwWDZMb1hGTnJzT0Nub0dMNlhtRkYxbjg1UjNPYzUrTHQyR1RtZDljekFtTyJ9 x-ctpclassification: CTP_NT dlp-product: dlpe-windows dlp-version: 11.0.400.15 dlp-reaction: no-action x-originating-ip: [10.239.127.40] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [dpdk-stable] [PATCH] net/ipn3ke: fix null pointer dereference X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" > -----Original Message----- > From: Pei, Andy > Sent: Thursday, May 23, 2019 12:31 > To: dev@dpdk.org > Cc: Pei, Andy ; Xu, Rosen ; > stable@dpdk.org > Subject: [PATCH] net/ipn3ke: fix null pointer dereference >=20 > In current code, scenario may happens that when function > ipn3ke_hw_tm_node_wr is called, struct ipn3ke_tm_node n has a NULL > element parent_node, however, the element parent_node of struct > ipn3ke_tm_node n is used in an invalid way. > After applying this patch, > this null pointer dereference is avoided. >=20 > Coverity issue: 337921 > Fixes: c820468ac99c ("net/ipn3ke: support TM") > Cc: rosen.xu@intel.com > Cc: stable@dpdk.org >=20 > Signed-off-by: Andy Pei > --- > drivers/net/ipn3ke/ipn3ke_tm.c | 43 +++++++++++++++++++++++-------------= -- > ---- > 1 file changed, 24 insertions(+), 19 deletions(-) >=20 > diff --git a/drivers/net/ipn3ke/ipn3ke_tm.c > b/drivers/net/ipn3ke/ipn3ke_tm.c index 4bcf3aa..30a3dfd 100644 > --- a/drivers/net/ipn3ke/ipn3ke_tm.c > +++ b/drivers/net/ipn3ke/ipn3ke_tm.c > @@ -1579,7 +1579,8 @@ struct ipn3ke_tm_shaper_params_range_type > ipn3ke_tm_shaper_params_rang[] =3D { >=20 > static int > ipn3ke_hw_tm_node_wr(struct ipn3ke_hw *hw, > - struct ipn3ke_tm_node *n) > + struct ipn3ke_tm_node *n, > + struct ipn3ke_tm_node *parent_node) > { > uint32_t level; >=20 > @@ -1650,11 +1651,12 @@ struct ipn3ke_tm_shaper_params_range_type > ipn3ke_tm_shaper_params_rang[] =3D { > /** > * Configure Map > */ > - IPN3KE_MASK_WRITE_REG(hw, > - IPN3KE_QOS_MAP_L2_X, > - n->node_index, > - n->parent_node->node_index, > - IPN3KE_QOS_MAP_L2_MASK); > + if (parent_node) > + IPN3KE_MASK_WRITE_REG(hw, > + IPN3KE_QOS_MAP_L2_X, > + n->node_index, > + parent_node->node_index, > + IPN3KE_QOS_MAP_L2_MASK); >=20 > break; > case IPN3KE_TM_NODE_LEVEL_COS: > @@ -1707,11 +1709,12 @@ struct ipn3ke_tm_shaper_params_range_type > ipn3ke_tm_shaper_params_rang[] =3D { > 0x80000000)) > ; >=20 > - IPN3KE_MASK_WRITE_REG(hw, > - IPN3KE_QM_UID_CONFIG_DATA, > - 0, > - (1 << 8 | n->parent_node->parent_node- > >node_index), > - 0x1FF); > + if (parent_node && parent_node->parent_node) > + IPN3KE_MASK_WRITE_REG(hw, > + IPN3KE_QM_UID_CONFIG_DATA, > + 0, > + (1 << 8 | parent_node->parent_node- > >node_index), > + 0x1FF); >=20 > IPN3KE_MASK_WRITE_REG(hw, > IPN3KE_QM_UID_CONFIG_CTRL, > @@ -1728,11 +1731,12 @@ struct ipn3ke_tm_shaper_params_range_type > ipn3ke_tm_shaper_params_rang[] =3D { > /** > * Configure Map > */ > - IPN3KE_MASK_WRITE_REG(hw, > - IPN3KE_QOS_MAP_L1_X, > - n->node_index, > - n->parent_node->node_index, > - IPN3KE_QOS_MAP_L1_MASK); > + if (parent_node) > + IPN3KE_MASK_WRITE_REG(hw, > + IPN3KE_QOS_MAP_L1_X, > + n->node_index, > + parent_node->node_index, > + IPN3KE_QOS_MAP_L1_MASK); >=20 > break; > default: > @@ -1772,7 +1776,8 @@ struct ipn3ke_tm_shaper_params_range_type > ipn3ke_tm_shaper_params_rang[] =3D { > NULL, > rte_strerror(EINVAL)); > } > - ipn3ke_hw_tm_node_wr(hw, n); > + parent_node =3D n->parent_node; > + ipn3ke_hw_tm_node_wr(hw, n, parent_node); > } >=20 > nl =3D &tm->h.vt_commit_node_list; > @@ -1802,7 +1807,7 @@ struct ipn3ke_tm_shaper_params_range_type > ipn3ke_tm_shaper_params_rang[] =3D { > NULL, > rte_strerror(EINVAL)); > } > - ipn3ke_hw_tm_node_wr(hw, n); > + ipn3ke_hw_tm_node_wr(hw, n, parent_node); > } >=20 > nl =3D &tm->h.cos_commit_node_list; > @@ -1836,7 +1841,7 @@ struct ipn3ke_tm_shaper_params_range_type > ipn3ke_tm_shaper_params_rang[] =3D { > NULL, > rte_strerror(EINVAL)); > } > - ipn3ke_hw_tm_node_wr(hw, n); > + ipn3ke_hw_tm_node_wr(hw, n, parent_node); > } >=20 > return 0; > -- > 1.8.3.1 Acked-by: Rosen Xu