From patchwork Thu Nov 10 08:30:52 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Yang X-Patchwork-Id: 119715 X-Patchwork-Delegate: qi.z.zhang@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 4DDDFA04FD; Thu, 10 Nov 2022 09:43:02 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id DCCE8400EF; Thu, 10 Nov 2022 09:43:01 +0100 (CET) Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by mails.dpdk.org (Postfix) with ESMTP id 2686C400D4 for ; Thu, 10 Nov 2022 09:43:00 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1668069782; x=1699605782; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Di6MqKmwiVLYRr363lvzgQQt5kh90bOdJBWTuQxf+yI=; b=nRQSLgepOlvDFuT+WOCz0c1uCjSaU+ql0+EOjSw8o8M3oHknlgNZ9Qxb tkBZN4sVMRyzd93+JX5VS+KrIphxK+uBgvNvc9OORssQnmqGG9ab1Aom5 G4RF74XJud/LawUfH8Or8TMXJNO6fJxVWJgOi3dRb9yqqCP6wc78VV+u3 OX0eEIVHIwwSuOqHGZHTN1uHCU4pKlJ5t2olcZUXlMwQ6BmDVz194CXFB bUlOlrnKGXdR1f2F9RhOQrOxrQJ1rctq1lRn/cMO/V9g8DsMQmUsngFuk rmVDmPansSEGa+ma3DPPi3ASI/URnWH+MqlBvwneE1QnW6Bz+LJvwKtX6 Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10526"; a="313028401" X-IronPort-AV: E=Sophos;i="5.96,153,1665471600"; d="scan'208";a="313028401" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by orsmga103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2022 00:42:54 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10526"; a="637093791" X-IronPort-AV: E=Sophos;i="5.96,153,1665471600"; d="scan'208";a="637093791" Received: from intel-cd-odc-steve.cd.intel.com ([10.240.178.136]) by orsmga002-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 10 Nov 2022 00:42:51 -0800 From: Steve Yang To: dev@dpdk.org Cc: jingjing.wu@intel.com, beilei.xing@intel.com, Steve Yang Subject: [PATCH v2] net/iavf: fix taninted scalar Date: Thu, 10 Nov 2022 08:30:52 +0000 Message-Id: <20221110083052.133399-1-stevex.yang@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20221110072529.132523-1-stevex.yang@intel.com> References: <20221110072529.132523-1-stevex.yang@intel.com> MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org tainted_data_downcast: Downcasting match_item->meta from void * to struct virtchnl_proto_hdrs implies that the data that this pointer points to is tainted. var_assign_var: Assigning: proto_hdrs = match_item->meta. Both are now tainted. var_assign_var: Assigning: rss_meta->proto_hdrs = *proto_hdrs. Both are now tainted. Passing tainted expression "rss_meta->proto_hdrs.count" to "iavf_refine_proto_hdrs", which uses it as a loop boundary. Removed temporary variable 'proto_hdrs', and copied whole memory of match_item meta with exact structure size to avoid data downcast. Coverity issue: 381131 Fixes: 91f27b2e39ab ("net/iavf: refactor RSS") Signed-off-by: Steve Yang Acked-by: Qi Zhang --- drivers/net/iavf/iavf_hash.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) diff --git a/drivers/net/iavf/iavf_hash.c b/drivers/net/iavf/iavf_hash.c index 67b05313eb..ae6fb38594 100644 --- a/drivers/net/iavf/iavf_hash.c +++ b/drivers/net/iavf/iavf_hash.c @@ -992,10 +992,9 @@ iavf_refine_proto_hdrs_l234(struct virtchnl_proto_hdrs *proto_hdrs, uint64_t rss_type) { struct virtchnl_proto_hdr *hdr; - int phdrs_count = proto_hdrs->count; int i; - for (i = 0; i < phdrs_count; i++) { + for (i = 0; i < proto_hdrs->count; i++) { hdr = &proto_hdrs->proto_hdr[i]; switch (hdr->type) { case VIRTCHNL_PROTO_HDR_ETH: @@ -1184,13 +1183,12 @@ iavf_refine_proto_hdrs_gtpu(struct virtchnl_proto_hdrs *proto_hdrs, uint64_t rss_type) { struct virtchnl_proto_hdr *hdr; - int phdrs_count = proto_hdrs->count; int i; if (!(rss_type & RTE_ETH_RSS_GTPU)) return; - for (i = 0; i < phdrs_count; i++) { + for (i = 0; i < proto_hdrs->count; i++) { hdr = &proto_hdrs->proto_hdr[i]; switch (hdr->type) { case VIRTCHNL_PROTO_HDR_GTPU_IP: @@ -1210,7 +1208,6 @@ iavf_refine_proto_hdrs_by_pattern(struct virtchnl_proto_hdrs *proto_hdrs, struct virtchnl_proto_hdr *hdr2; int i, shift_count = 1; int tun_lvl = proto_hdrs->tunnel_level; - int phdrs_count = 0; if (!(phint & IAVF_PHINT_GTPU_MSK) && !(phint & IAVF_PHINT_GRE)) return; @@ -1219,9 +1216,8 @@ iavf_refine_proto_hdrs_by_pattern(struct virtchnl_proto_hdrs *proto_hdrs, if (phint & IAVF_PHINT_LAYERS_MSK) shift_count = 2; - phdrs_count = proto_hdrs->count; /* shift headers layer */ - for (i = phdrs_count - 1 + shift_count; + for (i = proto_hdrs->count - 1 + shift_count; i > shift_count - 1; i--) { hdr1 = &proto_hdrs->proto_hdr[i]; hdr2 = &proto_hdrs->proto_hdr[i - shift_count]; @@ -1282,7 +1278,6 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs, uint64_t phint) { struct virtchnl_proto_hdr *hdr, *hdr1; - int phdrs_count = proto_hdrs->count; int i; if (!(phint & IAVF_PHINT_L2TPV2) && !(phint & IAVF_PHINT_L2TPV2_LEN)) @@ -1290,7 +1285,7 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs, if (proto_hdrs->tunnel_level == TUNNEL_LEVEL_INNER) { /* shift headers layer */ - for (i = phdrs_count; i > 0; i--) + for (i = proto_hdrs->count; i > 0; i--) proto_hdrs->proto_hdr[i] = proto_hdrs->proto_hdr[i - 1]; /* adding outer ip header at layer 0 */ @@ -1303,7 +1298,7 @@ iavf_refine_proto_hdrs_l2tpv2(struct virtchnl_proto_hdrs *proto_hdrs, else if (phint & IAVF_PHINT_OUTER_IPV6) VIRTCHNL_SET_PROTO_HDR_TYPE(hdr1, IPV6); } else { - for (i = 0; i < phdrs_count; i++) { + for (i = 0; i < proto_hdrs->count; i++) { hdr = &proto_hdrs->proto_hdr[i]; if (hdr->type == VIRTCHNL_PROTO_HDR_L2TPV2) { if (phint & IAVF_PHINT_L2TPV2) { @@ -1427,7 +1422,6 @@ iavf_hash_parse_action(struct iavf_pattern_match_item *match_item, uint64_t pattern_hint, struct iavf_rss_meta *rss_meta, struct rte_flow_error *error) { - struct virtchnl_proto_hdrs *proto_hdrs; enum rte_flow_action_type action_type; const struct rte_flow_action_rss *rss; const struct rte_flow_action *action; @@ -1488,8 +1482,10 @@ iavf_hash_parse_action(struct iavf_pattern_match_item *match_item, return rte_flow_error_set(error, ENOTSUP, RTE_FLOW_ERROR_TYPE_ACTION, action, "RSS type not supported"); - proto_hdrs = match_item->meta; - rss_meta->proto_hdrs = *proto_hdrs; + + memcpy(&rss_meta->proto_hdrs, match_item->meta, + sizeof(struct virtchnl_proto_hdrs)); + iavf_refine_proto_hdrs(&rss_meta->proto_hdrs, rss_type, pattern_hint); break;