From patchwork Wed Mar 17 08:21:33 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wei Huang X-Patchwork-Id: 89351 X-Patchwork-Delegate: qi.z.zhang@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 152FCA00C2; Wed, 17 Mar 2021 09:21:35 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 40BD3242B91; Wed, 17 Mar 2021 09:21:29 +0100 (CET) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mails.dpdk.org (Postfix) with ESMTP id 2F63A4014D; Wed, 17 Mar 2021 09:21:26 +0100 (CET) IronPort-SDR: TpD15DO90T1MT5Y+CUxwnvd/bMOsZVSvI8mD9FbtcXvkrkc+EwpjedPozYDnvRBW3ZaQpuHn/Q AE9au4eF25pQ== X-IronPort-AV: E=McAfee;i="6000,8403,9925"; a="274463930" X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="274463930" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Mar 2021 01:21:25 -0700 IronPort-SDR: NwFDmGQ02oE04H+wjwWR4xBSevEUOxGP3C3u41h7UFRXYVHcE3jy/C651lSghnh09oEb10dkuk pI/qCi5fyz8A== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="602144367" Received: from unknown (HELO sh_lab5_1.sh.intel.com) ([10.238.175.190]) by fmsmga006.fm.intel.com with ESMTP; 17 Mar 2021 01:21:24 -0700 From: Wei Huang To: dev@dpdk.org, rosen.xu@intel.com, qi.z.zhang@intel.com Cc: stable@dpdk.org, tianfei.zhang@intel.com, Wei Huang Date: Wed, 17 Mar 2021 04:21:33 -0400 Message-Id: <1615969296-17021-2-git-send-email-wei.huang@intel.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1615969296-17021-1-git-send-email-wei.huang@intel.com> References: <1615969296-17021-1-git-send-email-wei.huang@intel.com> Subject: [dpdk-dev] [PATCH v1 1/4] raw/ifpga/base: use trusted buffer to free X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In write_flash_image(), calling function "read" may taints variable "buf" which turn to an untrusted value as argument of "rte_free". Coverity issue: 367477 Fixes: 7a4f3993f269 ("raw/ifpga: add FPGA RSU APIs") Signed-off-by: Wei Huang Acked-by: Tianfei zhang Signed-off-by: Wei Huang Acked-by: Rosen Xu --- drivers/raw/ifpga/base/ifpga_fme_rsu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/raw/ifpga/base/ifpga_fme_rsu.c b/drivers/raw/ifpga/base/ifpga_fme_rsu.c index 28198abd78..d32f1eccb1 100644 --- a/drivers/raw/ifpga/base/ifpga_fme_rsu.c +++ b/drivers/raw/ifpga/base/ifpga_fme_rsu.c @@ -92,6 +92,7 @@ static int write_flash_image(struct ifpga_sec_mgr *smgr, const char *image, uint32_t offset) { void *buf = NULL; + void *buf_to_free = NULL; int retry = 0; uint32_t length = 0; uint32_t to_transfer = 0; @@ -122,6 +123,7 @@ static int write_flash_image(struct ifpga_sec_mgr *smgr, const char *image, close(fd); return -ENOMEM; } + buf_to_free = buf; length = smgr->rsu_length; one_percent = length / 100; @@ -177,7 +179,7 @@ static int write_flash_image(struct ifpga_sec_mgr *smgr, const char *image, printf("\n"); end: - free(buf); + free(buf_to_free); close(fd); return ret; } From patchwork Wed Mar 17 08:21:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wei Huang X-Patchwork-Id: 89352 X-Patchwork-Delegate: qi.z.zhang@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id E350BA00C2; Wed, 17 Mar 2021 09:21:40 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 877E8242B95; Wed, 17 Mar 2021 09:21:30 +0100 (CET) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mails.dpdk.org (Postfix) with ESMTP id 7AC94242B93; Wed, 17 Mar 2021 09:21:29 +0100 (CET) IronPort-SDR: dYvpKh/DDMiupn1BOBX6fomCRR5IcDiCcIcLvpfvLjbBAx/E2qjaF6rWpQ0tDoaoWEoCqFWxzt TzO5t0IrreJQ== X-IronPort-AV: E=McAfee;i="6000,8403,9925"; a="274463932" X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="274463932" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Mar 2021 01:21:27 -0700 IronPort-SDR: ilj1iQUHIGcCAQwtR5OeDlTsRP15GQnGmsPVIknl286ocoejWJb3rrhVe5ZiGqqkpmrBWQdMv3 ZMBxVkYb9dOw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="602144377" Received: from unknown (HELO sh_lab5_1.sh.intel.com) ([10.238.175.190]) by fmsmga006.fm.intel.com with ESMTP; 17 Mar 2021 01:21:26 -0700 From: Wei Huang To: dev@dpdk.org, rosen.xu@intel.com, qi.z.zhang@intel.com Cc: stable@dpdk.org, tianfei.zhang@intel.com, Wei Huang Date: Wed, 17 Mar 2021 04:21:34 -0400 Message-Id: <1615969296-17021-3-git-send-email-wei.huang@intel.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1615969296-17021-1-git-send-email-wei.huang@intel.com> References: <1615969296-17021-1-git-send-email-wei.huang@intel.com> Subject: [dpdk-dev] [PATCH v1 2/4] raw/ifpga/base: check return value of lseek X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In write_flash_image(), calling function "lseek" without checking return value has risk. Negative return value should be handled as an error condition. Coverity issue: 367478 Fixes: 7a4f3993f269 ("raw/ifpga: add FPGA RSU APIs") Signed-off-by: Wei Huang Acked-by: Tianfei zhang Signed-off-by: Wei Huang Acked-by: Rosen Xu --- drivers/raw/ifpga/base/ifpga_fme_rsu.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/raw/ifpga/base/ifpga_fme_rsu.c b/drivers/raw/ifpga/base/ifpga_fme_rsu.c index d32f1eccb1..a4cb2f54ba 100644 --- a/drivers/raw/ifpga/base/ifpga_fme_rsu.c +++ b/drivers/raw/ifpga/base/ifpga_fme_rsu.c @@ -130,7 +130,12 @@ static int write_flash_image(struct ifpga_sec_mgr *smgr, const char *image, do { to_transfer = (length > IFPGA_RSU_DATA_BLK_SIZE) ? IFPGA_RSU_DATA_BLK_SIZE : length; - lseek(fd, offset, SEEK_SET); + if (lseek(fd, offset, SEEK_SET) < 0) { + dev_err(smgr, "Failed to seek in \'%s\' [e:%s]\n", + image, strerror(errno)); + ret = -EIO; + goto end; + } read_size = read(fd, buf, to_transfer); if (read_size < 0) { dev_err(smgr, "Failed to read from \'%s\' [e:%s]\n", From patchwork Wed Mar 17 08:21:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wei Huang X-Patchwork-Id: 89353 X-Patchwork-Delegate: qi.z.zhang@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 61690A00C2; Wed, 17 Mar 2021 09:21:48 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id F1D7C242B8E; Wed, 17 Mar 2021 09:21:32 +0100 (CET) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mails.dpdk.org (Postfix) with ESMTP id 40D6F242B8B; Wed, 17 Mar 2021 09:21:30 +0100 (CET) IronPort-SDR: rVX/O3pWNidfLNxoSrwkIwORbGzGEsmmTUFe+sy7SVRk6hcJddPvRCacxf1ISavePFzBBjXdxX DPtdBTjn/5FQ== X-IronPort-AV: E=McAfee;i="6000,8403,9925"; a="274463935" X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="274463935" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Mar 2021 01:21:29 -0700 IronPort-SDR: ROmBbgwCiO1lJLvLzR+rT4aoPd/RAypzR3iF38C25g6ITYETI880ZDKvokqcmzOjc/OMMFxXn6 xPHlNZ3LykuQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="602144384" Received: from unknown (HELO sh_lab5_1.sh.intel.com) ([10.238.175.190]) by fmsmga006.fm.intel.com with ESMTP; 17 Mar 2021 01:21:27 -0700 From: Wei Huang To: dev@dpdk.org, rosen.xu@intel.com, qi.z.zhang@intel.com Cc: stable@dpdk.org, tianfei.zhang@intel.com, Wei Huang Date: Wed, 17 Mar 2021 04:21:35 -0400 Message-Id: <1615969296-17021-4-git-send-email-wei.huang@intel.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1615969296-17021-1-git-send-email-wei.huang@intel.com> References: <1615969296-17021-1-git-send-email-wei.huang@intel.com> Subject: [dpdk-dev] [PATCH v1 3/4] raw/ifpga/base: assign unsigned value to length X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In fpga_update_flash(), "smgr->rsu_length" is passed to a parameter that cannot be negative. So return value of function "lseek" should be checked before being assigned to "smgr->rsu_length". Coverity issue: 367481 Fixes: 7a4f3993f269 ("raw/ifpga: add FPGA RSU APIs") Signed-off-by: Wei Huang Acked-by: Tianfei zhang Signed-off-by: Wei Huang Acked-by: Rosen Xu --- drivers/raw/ifpga/base/ifpga_fme_rsu.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/raw/ifpga/base/ifpga_fme_rsu.c b/drivers/raw/ifpga/base/ifpga_fme_rsu.c index a4cb2f54ba..79ee37c282 100644 --- a/drivers/raw/ifpga/base/ifpga_fme_rsu.c +++ b/drivers/raw/ifpga/base/ifpga_fme_rsu.c @@ -277,6 +277,7 @@ int fpga_update_flash(struct ifpga_fme_hw *fme, const char *image, struct ifpga_sec_mgr *smgr = NULL; uint32_t rsu_stat = 0; int fd = -1; + off_t len = 0; struct sigaction old_sigint_action; struct sigaction sa; time_t start; @@ -320,9 +321,21 @@ int fpga_update_flash(struct ifpga_fme_hw *fme, const char *image, image, strerror(errno)); return -EIO; } - smgr->rsu_length = lseek(fd, 0, SEEK_END); + len = lseek(fd, 0, SEEK_END); close(fd); + if (len < 0) { + dev_err(smgr, + "Failed to get file length of \'%s\' [e:%s]\n", + image, strerror(errno)); + return -EIO; + } + if (len == 0) { + dev_err(smgr, "Length of file \'%s\' is invalid\n", image); + return -EINVAL; + } + smgr->rsu_length = len; + if (smgr->max10_dev->staging_area_size < smgr->rsu_length) { dev_err(dev, "Size of staging area is small than image length " "[%u<%u]\n", smgr->max10_dev->staging_area_size, From patchwork Wed Mar 17 08:21:36 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wei Huang X-Patchwork-Id: 89354 X-Patchwork-Delegate: qi.z.zhang@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id C159BA00C2; Wed, 17 Mar 2021 09:21:54 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 625F5242BA8; Wed, 17 Mar 2021 09:21:34 +0100 (CET) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mails.dpdk.org (Postfix) with ESMTP id 1DE9A242BA1; Wed, 17 Mar 2021 09:21:31 +0100 (CET) IronPort-SDR: d4BtLmVzQ2BWhudgnyD+UXgXRaabfpB8sqN08+A+t95UY3F8QsGwddgW3P7uGIf3KWY1NgNatj /j9xNuE556Yg== X-IronPort-AV: E=McAfee;i="6000,8403,9925"; a="274463938" X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="274463938" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Mar 2021 01:21:31 -0700 IronPort-SDR: MdlDyPXNNscdwfqKU0uh9o8XTqP7RDY4w0IuL+cuMUv2HqHHm1UEy5ONlHJJwM2DdcJojxKkUz i5kyR4lmm2DA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,255,1610438400"; d="scan'208";a="602144391" Received: from unknown (HELO sh_lab5_1.sh.intel.com) ([10.238.175.190]) by fmsmga006.fm.intel.com with ESMTP; 17 Mar 2021 01:21:29 -0700 From: Wei Huang To: dev@dpdk.org, rosen.xu@intel.com, qi.z.zhang@intel.com Cc: stable@dpdk.org, tianfei.zhang@intel.com, Wei Huang Date: Wed, 17 Mar 2021 04:21:36 -0400 Message-Id: <1615969296-17021-5-git-send-email-wei.huang@intel.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1615969296-17021-1-git-send-email-wei.huang@intel.com> References: <1615969296-17021-1-git-send-email-wei.huang@intel.com> Subject: [dpdk-dev] [PATCH v1 4/4] raw/ifpga/base: check pointer before dereferencing X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In init_sec_mgr(), pointer "hw" may be NULL, so "hw" should be checked before dereferencing. Coverity issue: 367483 Fixes: 7a4f3993f269 ("raw/ifpga: add FPGA RSU APIs") Signed-off-by: Wei Huang Acked-by: Tianfei zhang Signed-off-by: Wei Huang Acked-by: Rosen Xu --- drivers/raw/ifpga/base/ifpga_sec_mgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/raw/ifpga/base/ifpga_sec_mgr.c b/drivers/raw/ifpga/base/ifpga_sec_mgr.c index 4cf1db3049..15fb5b6d4d 100644 --- a/drivers/raw/ifpga/base/ifpga_sec_mgr.c +++ b/drivers/raw/ifpga/base/ifpga_sec_mgr.c @@ -610,7 +610,7 @@ int init_sec_mgr(struct ifpga_fme_hw *fme) smgr->rsu_status = NULL; } - if ((hw->pci_data->device_id == IFPGA_N3000_DID) && + if (hw && (hw->pci_data->device_id == IFPGA_N3000_DID) && (hw->pci_data->vendor_id == IFPGA_N3000_VID)) { smgr->ops = &n3000_sec_ops; smgr->copy_speed = IFPGA_N3000_COPY_SPEED;