bus/dpaa: fix outside array bounds error with GCC v13
Checks
Commit Message
when RTE_ENABLE_ASSERT is enable, DPAA driver is doing
wrong NULL check on frame queue which allows the code
to have access to NULL address.
GCC v13 is giving array bounds error if code is
accessing any memory region less than 4KB.
This patch fixes this issue by adding proper NULL checks
on frame queue.
Please refer: https://bugs.dpdk.org/show_bug.cgi?id=1233
Bugzilla ID: 1233
Fixes: c47ff048b99a ("bus/dpaa: add QMAN driver core routines")
Cc: stable@dpdk.org
Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
---
drivers/bus/dpaa/base/qbman/qman.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
Comments
Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
On 21-Jul-23 10:58 AM, Gagandeep Singh wrote:
> Caution: This is an external email. Please take care when clicking links or opening attachments. When in doubt, report the message using the 'Report this email' button
>
>
> when RTE_ENABLE_ASSERT is enable, DPAA driver is doing
> wrong NULL check on frame queue which allows the code
> to have access to NULL address.
> GCC v13 is giving array bounds error if code is
> accessing any memory region less than 4KB.
> This patch fixes this issue by adding proper NULL checks
> on frame queue.
>
> Please refer: https://bugs.dpdk.org/show_bug.cgi?id=1233
>
> Bugzilla ID: 1233
> Fixes: c47ff048b99a ("bus/dpaa: add QMAN driver core routines")
> Cc: stable@dpdk.org
>
> Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
> ---
> drivers/bus/dpaa/base/qbman/qman.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/bus/dpaa/base/qbman/qman.c b/drivers/bus/dpaa/base/qbman/qman.c
> index 3949bf8712..83db0a534e 100644
> --- a/drivers/bus/dpaa/base/qbman/qman.c
> +++ b/drivers/bus/dpaa/base/qbman/qman.c
> @@ -1,7 +1,7 @@
> /* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0)
> *
> * Copyright 2008-2016 Freescale Semiconductor Inc.
> - * Copyright 2017,2019 NXP
> + * Copyright 2017,2019-2023 NXP
> *
> */
>
> @@ -897,7 +897,7 @@ static u32 __poll_portal_slow(struct qman_portal *p, u32 is)
> /* Lookup in the retirement table */
> fq = table_find_fq(p,
> be32_to_cpu(msg->fq.fqid));
> - DPAA_BUG_ON(!fq);
> + DPAA_BUG_ON(fq != NULL);
> fq_state_change(p, fq, &swapped_msg, verb);
> if (fq->cb.fqs)
> fq->cb.fqs(p, fq, &swapped_msg);
> @@ -909,6 +909,7 @@ static u32 __poll_portal_slow(struct qman_portal *p, u32 is)
> #else
> fq = (void *)(uintptr_t)msg->fq.contextB;
> #endif
> + DPAA_BUG_ON(fq != NULL);
> fq_state_change(p, fq, msg, verb);
> if (fq->cb.fqs)
> fq->cb.fqs(p, fq, &swapped_msg);
> --
> 2.25.1
>
On Fri, Jul 21, 2023 at 4:18 PM Hemant Agrawal
<hemant.agrawal@oss.nxp.com> wrote:
>
> Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
Acked-by: Jerin Jacob <jerinj@marvell.com>
>
> On 21-Jul-23 10:58 AM, Gagandeep Singh wrote:
> > Caution: This is an external email. Please take care when clicking links or opening attachments. When in doubt, report the message using the 'Report this email' button
> >
> >
> > when RTE_ENABLE_ASSERT is enable, DPAA driver is doing
> > wrong NULL check on frame queue which allows the code
> > to have access to NULL address.
> > GCC v13 is giving array bounds error if code is
> > accessing any memory region less than 4KB.
> > This patch fixes this issue by adding proper NULL checks
> > on frame queue.
> >
> > Please refer: https://bugs.dpdk.org/show_bug.cgi?id=1233
> >
> > Bugzilla ID: 1233
> > Fixes: c47ff048b99a ("bus/dpaa: add QMAN driver core routines")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
> > ---
> > drivers/bus/dpaa/base/qbman/qman.c | 5 +++--
> > 1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/bus/dpaa/base/qbman/qman.c b/drivers/bus/dpaa/base/qbman/qman.c
> > index 3949bf8712..83db0a534e 100644
> > --- a/drivers/bus/dpaa/base/qbman/qman.c
> > +++ b/drivers/bus/dpaa/base/qbman/qman.c
> > @@ -1,7 +1,7 @@
> > /* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0)
> > *
> > * Copyright 2008-2016 Freescale Semiconductor Inc.
> > - * Copyright 2017,2019 NXP
> > + * Copyright 2017,2019-2023 NXP
> > *
> > */
> >
> > @@ -897,7 +897,7 @@ static u32 __poll_portal_slow(struct qman_portal *p, u32 is)
> > /* Lookup in the retirement table */
> > fq = table_find_fq(p,
> > be32_to_cpu(msg->fq.fqid));
> > - DPAA_BUG_ON(!fq);
> > + DPAA_BUG_ON(fq != NULL);
> > fq_state_change(p, fq, &swapped_msg, verb);
> > if (fq->cb.fqs)
> > fq->cb.fqs(p, fq, &swapped_msg);
> > @@ -909,6 +909,7 @@ static u32 __poll_portal_slow(struct qman_portal *p, u32 is)
> > #else
> > fq = (void *)(uintptr_t)msg->fq.contextB;
> > #endif
> > + DPAA_BUG_ON(fq != NULL);
> > fq_state_change(p, fq, msg, verb);
> > if (fq->cb.fqs)
> > fq->cb.fqs(p, fq, &swapped_msg);
> > --
> > 2.25.1
> >
On Fri, Jul 21, 2023 at 7:28 AM Gagandeep Singh <g.singh@nxp.com> wrote:
>
> when RTE_ENABLE_ASSERT is enable, DPAA driver is doing
> wrong NULL check on frame queue which allows the code
> to have access to NULL address.
> GCC v13 is giving array bounds error if code is
> accessing any memory region less than 4KB.
> This patch fixes this issue by adding proper NULL checks
> on frame queue.
>
> Bugzilla ID: 1233
> Fixes: c47ff048b99a ("bus/dpaa: add QMAN driver core routines")
> Cc: stable@dpdk.org
>
> Signed-off-by: Gagandeep Singh <g.singh@nxp.com>
> Acked-by: Hemant Agrawal <hemant.agrawal@nxp.com>
> Acked-by: Jerin Jacob <jerinj@marvell.com>
Applied, thanks.
@@ -1,7 +1,7 @@
/* SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0)
*
* Copyright 2008-2016 Freescale Semiconductor Inc.
- * Copyright 2017,2019 NXP
+ * Copyright 2017,2019-2023 NXP
*
*/
@@ -897,7 +897,7 @@ static u32 __poll_portal_slow(struct qman_portal *p, u32 is)
/* Lookup in the retirement table */
fq = table_find_fq(p,
be32_to_cpu(msg->fq.fqid));
- DPAA_BUG_ON(!fq);
+ DPAA_BUG_ON(fq != NULL);
fq_state_change(p, fq, &swapped_msg, verb);
if (fq->cb.fqs)
fq->cb.fqs(p, fq, &swapped_msg);
@@ -909,6 +909,7 @@ static u32 __poll_portal_slow(struct qman_portal *p, u32 is)
#else
fq = (void *)(uintptr_t)msg->fq.contextB;
#endif
+ DPAA_BUG_ON(fq != NULL);
fq_state_change(p, fq, msg, verb);
if (fq->cb.fqs)
fq->cb.fqs(p, fq, &swapped_msg);