From patchwork Thu May 7 09:31:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alvin Zhang X-Patchwork-Id: 69916 X-Patchwork-Delegate: xiaolong.ye@intel.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 590B0A00C5; Thu, 7 May 2020 11:33:47 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 0D2961DADA; Thu, 7 May 2020 11:33:47 +0200 (CEST) Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by dpdk.org (Postfix) with ESMTP id 4905C1D9D3 for ; Thu, 7 May 2020 11:33:45 +0200 (CEST) IronPort-SDR: Hn8uhXnrwiGwBOT1JrEQFUwx5wVqBQwjGL7aqQJsk2meraI2zvBDGkdJrNkS92kiNDwq0lelfh BrNoyPx/8+uQ== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 07 May 2020 02:33:44 -0700 IronPort-SDR: 3rJWb7aQnI8ORC5EXC3+JlyhyHRVbVHvDQEZsgOb8O8XSHjuJ3z926fPfmGBmOTVsEtyZKdcr4 aeL+0iM2JklA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.73,363,1583222400"; d="scan'208";a="295660724" Received: from shwdenpg235.ccr.corp.intel.com ([10.240.182.60]) by fmsmga002.fm.intel.com with ESMTP; 07 May 2020 02:33:42 -0700 From: alvinx.zhang@intel.com To: dev@dpdk.org Cc: wei.zhao1@intel.com, jia.guo@intel.com, xiaolong.ye@intel.com Date: Thu, 7 May 2020 17:31:56 +0800 Message-Id: <20200507093156.18616-1-alvinx.zhang@intel.com> X-Mailer: git-send-email 2.21.0.windows.1 In-Reply-To: <20200507090853.16832-1-alvinx.zhang@intel.com> References: <20200507090853.16832-1-alvinx.zhang@intel.com> MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH v2] net/igc: fix memory illegal accesses X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Alvin Zhang Fix some out-of-bounds memory issues, they may lead to wrong results or affect application stability. Fixes: bd3fcf0d0fa1 (net/igc: support RSS) Cc: stable@dpdk.org Signed-off-by: Alvin Zhang Reviewed-by: Jeff Guo --- V2: update git log drivers/net/igc/igc_ethdev.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/igc/igc_ethdev.c b/drivers/net/igc/igc_ethdev.c index 16d98c6..6ab3ee9 100644 --- a/drivers/net/igc/igc_ethdev.c +++ b/drivers/net/igc/igc_ethdev.c @@ -2266,6 +2266,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, return -EINVAL; } + RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); + /* set redirection table */ for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { union igc_rss_reta_reg reta, reg; @@ -2278,7 +2280,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RSS_RDT_REG_SIZE_MASK); /* if no need to update the register */ - if (!mask) + if (!mask || + shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) continue; /* check mask whether need to read the register value first */ @@ -2289,6 +2292,7 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); /* update the register */ + RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { if (mask & (1u << j)) reta.bytes[j] = @@ -2318,6 +2322,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, return -EINVAL; } + RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); + /* read redirection table */ for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { union igc_rss_reta_reg reta; @@ -2330,10 +2336,12 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, IGC_RSS_RDT_REG_SIZE_MASK); /* if no need to read register */ - if (!mask) + if (!mask || + shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) continue; /* read register and get the queue index */ + RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); reta.dword = IGC_READ_REG_LE_VALUE(hw, IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) {