From patchwork Thu Jun 30 07:35:30 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Xing, Beilei" X-Patchwork-Id: 14464 X-Patchwork-Delegate: bruce.richardson@intel.com Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [IPv6:::1]) by dpdk.org (Postfix) with ESMTP id 7BC4F2C2F; Thu, 30 Jun 2016 09:36:01 +0200 (CEST) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by dpdk.org (Postfix) with ESMTP id F41712C2F for ; Thu, 30 Jun 2016 09:35:59 +0200 (CEST) Received: from orsmga003.jf.intel.com ([10.7.209.27]) by fmsmga103.fm.intel.com with ESMTP; 30 Jun 2016 00:35:42 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.26,550,1459839600"; d="scan'208";a="837852374" Received: from shvmail01.sh.intel.com ([10.239.29.42]) by orsmga003.jf.intel.com with ESMTP; 30 Jun 2016 00:35:41 -0700 Received: from shecgisg004.sh.intel.com (shecgisg004.sh.intel.com [10.239.29.89]) by shvmail01.sh.intel.com with ESMTP id u5U7ZY0e026575; Thu, 30 Jun 2016 15:35:34 +0800 Received: from shecgisg004.sh.intel.com (localhost [127.0.0.1]) by shecgisg004.sh.intel.com (8.13.6/8.13.6/SuSE Linux 0.8) with ESMTP id u5U7ZV4f014540; Thu, 30 Jun 2016 15:35:33 +0800 Received: (from beileixi@localhost) by shecgisg004.sh.intel.com (8.13.6/8.13.6/Submit) id u5U7ZVwT014536; Thu, 30 Jun 2016 15:35:31 +0800 From: Beilei Xing To: jingjing.wu@intel.com, michalx.k.jastrzebski@intel.com Cc: dev@dpdk.org, Beilei Xing Date: Thu, 30 Jun 2016 15:35:30 +0800 Message-Id: <1467272130-14506-1-git-send-email-beilei.xing@intel.com> X-Mailer: git-send-email 1.7.4.1 Subject: [dpdk-dev] [PATCH 3/4] i40e: fix out-of-bounds access X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" When calling i40e_flowtype_to_pctype in i40e_get_hash_filter_global_config and i40e_set_hash_filter_global_config, function i40e_flowtype_to_pctype will be possibly out-of-bounds accessed, because size of callee's array is 15. So judge flow type before calling i40e_flowtype_to_pctype. Meanwhile do the same change in other functions. Fixes: 782c8c92f13f ("i40e: add hash configuration") Fixes: f2b2e2354bbd ("i40e: split function for hash and flow director input") Fixes: 98f055707685 ("i40e: configure input fields for RSS or flow director") Signed-off-by: Beilei Xing --- drivers/net/i40e/i40e_ethdev.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c index 78ed6d0..678e23a 100644 --- a/drivers/net/i40e/i40e_ethdev.c +++ b/drivers/net/i40e/i40e_ethdev.c @@ -6625,6 +6625,9 @@ i40e_get_hash_filter_global_config(struct i40e_hw *hw, mask &= ~(1UL << i); /* Bit set indicats the coresponding flow type is supported */ g_cfg->valid_bit_mask[0] |= (1UL << i); + /* if flowtype is invalid, continue */ + if (!I40E_VALID_FLOW(i)) + continue; pctype = i40e_flowtype_to_pctype(i); reg = i40e_read_rx_ctl(hw, I40E_GLQF_HSYM(pctype)); if (reg & I40E_GLQF_HSYM_SYMH_ENA_MASK) @@ -6696,6 +6699,9 @@ i40e_set_hash_filter_global_config(struct i40e_hw *hw, if (!(mask0 & (1UL << i))) continue; mask0 &= ~(1UL << i); + /* if flowtype is invalid, continue */ + if (!I40E_VALID_FLOW(i)) + continue; pctype = i40e_flowtype_to_pctype(i); reg = (g_cfg->sym_hash_enable_mask[0] & (1UL << i)) ? I40E_GLQF_HSYM_SYMH_ENA_MASK : 0; @@ -7258,13 +7264,11 @@ i40e_hash_filter_inset_select(struct i40e_hw *hw, return -EINVAL; } - pctype = i40e_flowtype_to_pctype(conf->flow_type); - if (pctype == 0 || pctype > I40E_FILTER_PCTYPE_L2_PAYLOAD) { - PMD_DRV_LOG(ERR, "Not supported flow type (%u)", - conf->flow_type); + if (!I40E_VALID_FLOW(conf->flow_type)) { + PMD_DRV_LOG(ERR, "invalid flow_type input."); return -EINVAL; } - + pctype = i40e_flowtype_to_pctype(conf->flow_type); ret = i40e_parse_input_set(&input_set, pctype, conf->field, conf->inset_size); if (ret) { @@ -7329,12 +7333,11 @@ i40e_fdir_filter_inset_select(struct i40e_pf *pf, return -EINVAL; } - pctype = i40e_flowtype_to_pctype(conf->flow_type); - if (pctype == 0 || pctype > I40E_FILTER_PCTYPE_L2_PAYLOAD) { - PMD_DRV_LOG(ERR, "Not supported flow type (%u)", - conf->flow_type); + if (!I40E_VALID_FLOW(conf->flow_type)) { + PMD_DRV_LOG(ERR, "invalid flow_type input."); return -EINVAL; } + pctype = i40e_flowtype_to_pctype(conf->flow_type); ret = i40e_parse_input_set(&input_set, pctype, conf->field, conf->inset_size); if (ret) {