From patchwork Thu May 7 02:01:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alvin Zhang X-Patchwork-Id: 69892 X-Patchwork-Delegate: xiaolong.ye@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id AA4BCA00C5; Thu, 7 May 2020 04:03:44 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 590101D5FE; Thu, 7 May 2020 04:03:44 +0200 (CEST) Received: from mga12.intel.com (mga12.intel.com [192.55.52.136]) by dpdk.org (Postfix) with ESMTP id B320E1D5FC for ; Thu, 7 May 2020 04:03:42 +0200 (CEST) IronPort-SDR: zYU4vCD3FdIhy8evFUWoI4lqyE7mTipAH4tiIT+hQ5u/tfWa9zo2n5qq1zQiJg+Zi4Gudx0Xvw kXkPg9EAuS+w== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga106.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 May 2020 19:03:41 -0700 IronPort-SDR: 4E4edC89AisIaM2c1r86AMWOTHhz8pbcw9ziF+t5AapYfly6qARcP50+1CrCC9wjIxMxmnIzsw 37IWdRJuj8BA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,361,1583222400"; d="scan'208";a="295551075" Received: from shwdenpg235.ccr.corp.intel.com ([10.240.182.60]) by fmsmga002.fm.intel.com with ESMTP; 06 May 2020 19:03:40 -0700 From: alvinx.zhang@intel.com To: dev@dpdk.org Cc: wei.zhao1@intel.com, jia.guo@intel.com, xiaolong.ye@intel.com Date: Thu, 7 May 2020 10:01:33 +0800 Message-Id: <20200507020133.14412-1-alvinx.zhang@intel.com> X-Mailer: git-send-email 2.21.0.windows.1 MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH] net/igc: fix memory illegal accesses X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Alvin Zhang Add memory access out-of-bounds check. Fixes: bd3fcf0d0fa1 (net/igc: support RSS) Cc: stable@dpdk.org Signed-off-by: Alvin Zhang --- drivers/net/igc/igc_ethdev.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/igc/igc_ethdev.c b/drivers/net/igc/igc_ethdev.c index 16d98c6..ced8ffd 100644 --- a/drivers/net/igc/igc_ethdev.c +++ b/drivers/net/igc/igc_ethdev.c @@ -2266,6 +2266,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, return -EINVAL; } + RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); + /* set redirection table */ for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { union igc_rss_reta_reg reta, reg; @@ -2278,7 +2280,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RSS_RDT_REG_SIZE_MASK); /* if no need to update the register */ - if (!mask) + if (!mask || + shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) continue; /* check mask whether need to read the register value first */ @@ -2289,6 +2292,7 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); /* update the register */ + RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { if (mask & (1u << j)) reta.bytes[j] = @@ -2318,6 +2322,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, return -EINVAL; } + RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); + /* read redirection table */ for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { union igc_rss_reta_reg reta; @@ -2330,12 +2336,14 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RSS_RDT_REG_SIZE_MASK); /* if no need to read register */ - if (!mask) + if (!mask || + shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) continue; /* read register and get the queue index */ reta.dword = IGC_READ_REG_LE_VALUE(hw, IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); + RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { if (mask & (1u << j)) reta_conf[idx].reta[shift + j] = reta.bytes[j];