From: Ajit Khaparde <ajit.khaparde@broadcom.com>
To: dev@dpdk.org
Cc: stable@dpdk.org,
Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
Subject: [PATCH v2 08/14] net/bnxt: fix array overflow
Date: Sat, 9 Dec 2023 17:24:49 -0800 [thread overview]
Message-ID: <20231210012455.20229-9-ajit.khaparde@broadcom.com> (raw)
In-Reply-To: <20231210012455.20229-1-ajit.khaparde@broadcom.com>
[-- Attachment #1: Type: text/plain, Size: 4601 bytes --]
In some cases the number of elements in the context memory array
can exceed the MAX_CTX_PAGES and that can cause the static members
ctx_pg_arr and ctx_dma_arr to overflow.
Allocate them dynamically to prevent this overflow.
Cc: stable@dpdk.org
Fixes: f8168ca0e690 ("net/bnxt: support thor controller")
Signed-off-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Reviewed-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
---
drivers/net/bnxt/bnxt.h | 4 ++--
drivers/net/bnxt/bnxt_ethdev.c | 42 +++++++++++++++++++++++++++-------
2 files changed, 36 insertions(+), 10 deletions(-)
diff --git a/drivers/net/bnxt/bnxt.h b/drivers/net/bnxt/bnxt.h
index 7439ecf4fa..3fbdf1ddcc 100644
--- a/drivers/net/bnxt/bnxt.h
+++ b/drivers/net/bnxt/bnxt.h
@@ -455,8 +455,8 @@ struct bnxt_ring_mem_info {
struct bnxt_ctx_pg_info {
uint32_t entries;
- void *ctx_pg_arr[MAX_CTX_PAGES];
- rte_iova_t ctx_dma_arr[MAX_CTX_PAGES];
+ void **ctx_pg_arr;
+ rte_iova_t *ctx_dma_arr;
struct bnxt_ring_mem_info ring_mem;
};
diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index 2a41fafa02..c585373ba3 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -4767,7 +4767,7 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp,
{
struct bnxt_ring_mem_info *rmem = &ctx_pg->ring_mem;
const struct rte_memzone *mz = NULL;
- char mz_name[RTE_MEMZONE_NAMESIZE];
+ char name[RTE_MEMZONE_NAMESIZE];
rte_iova_t mz_phys_addr;
uint64_t valid_bits = 0;
uint32_t sz;
@@ -4779,6 +4779,19 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp,
rmem->nr_pages = RTE_ALIGN_MUL_CEIL(mem_size, BNXT_PAGE_SIZE) /
BNXT_PAGE_SIZE;
rmem->page_size = BNXT_PAGE_SIZE;
+
+ snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_pg_arr%s_%x_%d",
+ suffix, idx, bp->eth_dev->data->port_id);
+ ctx_pg->ctx_pg_arr = rte_zmalloc(name, sizeof(void *) * rmem->nr_pages, 0);
+ if (ctx_pg->ctx_pg_arr == NULL)
+ return -ENOMEM;
+
+ snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_dma_arr%s_%x_%d",
+ suffix, idx, bp->eth_dev->data->port_id);
+ ctx_pg->ctx_dma_arr = rte_zmalloc(name, sizeof(rte_iova_t *) * rmem->nr_pages, 0);
+ if (ctx_pg->ctx_dma_arr == NULL)
+ return -ENOMEM;
+
rmem->pg_arr = ctx_pg->ctx_pg_arr;
rmem->dma_arr = ctx_pg->ctx_dma_arr;
rmem->flags = BNXT_RMEM_VALID_PTE_FLAG;
@@ -4786,13 +4799,13 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp,
valid_bits = PTU_PTE_VALID;
if (rmem->nr_pages > 1) {
- snprintf(mz_name, RTE_MEMZONE_NAMESIZE,
+ snprintf(name, RTE_MEMZONE_NAMESIZE,
"bnxt_ctx_pg_tbl%s_%x_%d",
suffix, idx, bp->eth_dev->data->port_id);
- mz_name[RTE_MEMZONE_NAMESIZE - 1] = 0;
- mz = rte_memzone_lookup(mz_name);
+ name[RTE_MEMZONE_NAMESIZE - 1] = 0;
+ mz = rte_memzone_lookup(name);
if (!mz) {
- mz = rte_memzone_reserve_aligned(mz_name,
+ mz = rte_memzone_reserve_aligned(name,
rmem->nr_pages * 8,
bp->eth_dev->device->numa_node,
RTE_MEMZONE_2MB |
@@ -4811,11 +4824,11 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp,
rmem->pg_tbl_mz = mz;
}
- snprintf(mz_name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_%s_%x_%d",
+ snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_%s_%x_%d",
suffix, idx, bp->eth_dev->data->port_id);
- mz = rte_memzone_lookup(mz_name);
+ mz = rte_memzone_lookup(name);
if (!mz) {
- mz = rte_memzone_reserve_aligned(mz_name,
+ mz = rte_memzone_reserve_aligned(name,
mem_size,
bp->eth_dev->device->numa_node,
RTE_MEMZONE_1GB |
@@ -4861,6 +4874,17 @@ static void bnxt_free_ctx_mem(struct bnxt *bp)
return;
bp->ctx->flags &= ~BNXT_CTX_FLAG_INITED;
+ rte_free(bp->ctx->qp_mem.ctx_pg_arr);
+ rte_free(bp->ctx->srq_mem.ctx_pg_arr);
+ rte_free(bp->ctx->cq_mem.ctx_pg_arr);
+ rte_free(bp->ctx->vnic_mem.ctx_pg_arr);
+ rte_free(bp->ctx->stat_mem.ctx_pg_arr);
+ rte_free(bp->ctx->qp_mem.ctx_dma_arr);
+ rte_free(bp->ctx->srq_mem.ctx_dma_arr);
+ rte_free(bp->ctx->cq_mem.ctx_dma_arr);
+ rte_free(bp->ctx->vnic_mem.ctx_dma_arr);
+ rte_free(bp->ctx->stat_mem.ctx_dma_arr);
+
rte_memzone_free(bp->ctx->qp_mem.ring_mem.mz);
rte_memzone_free(bp->ctx->srq_mem.ring_mem.mz);
rte_memzone_free(bp->ctx->cq_mem.ring_mem.mz);
@@ -4873,6 +4897,8 @@ static void bnxt_free_ctx_mem(struct bnxt *bp)
rte_memzone_free(bp->ctx->stat_mem.ring_mem.pg_tbl_mz);
for (i = 0; i < bp->ctx->tqm_fp_rings_count + 1; i++) {
+ rte_free(bp->ctx->tqm_mem[i]->ctx_pg_arr);
+ rte_free(bp->ctx->tqm_mem[i]->ctx_dma_arr);
if (bp->ctx->tqm_mem[i])
rte_memzone_free(bp->ctx->tqm_mem[i]->ring_mem.mz);
}
--
2.39.2 (Apple Git-143)
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4218 bytes --]
next prev parent reply other threads:[~2023-12-10 1:32 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-10 1:24 [PATCH v2 00/14] support new 5760X P7 devices Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 01/14] net/bnxt: refactor epoch setting Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 02/14] net/bnxt: update HWRM API Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 03/14] net/bnxt: log a message when multicast promisc mode changes Ajit Khaparde
2023-12-10 17:56 ` Stephen Hemminger
2023-12-10 22:58 ` Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 04/14] net/bnxt: use the correct COS queue for Tx Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 05/14] net/bnxt: refactor mem zone allocation Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 06/14] net/bnxt: add support for p7 device family Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 07/14] net/bnxt: refactor code to support P7 devices Ajit Khaparde
2023-12-10 1:24 ` Ajit Khaparde [this message]
2023-12-10 1:24 ` [PATCH v2 09/14] net/bnxt: add support for backing store v2 Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 10/14] net/bnxt: refactor the ulp initialization Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 11/14] net/bnxt: modify sending new HWRM commands to firmware Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 12/14] net/bnxt: retry HWRM ver get if the command fails Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 13/14] net/bnxt: cap ring resources for P7 devices Ajit Khaparde
2023-12-10 1:24 ` [PATCH v2 14/14] net/bnxt: add support for v3 Rx completion Ajit Khaparde
2023-12-13 5:33 ` [PATCH v2 00/14] support new 5760X P7 devices Ajit Khaparde
2023-12-13 7:57 ` David Marchand
2023-12-13 14:49 ` Ajit Khaparde
2023-12-13 19:09 ` Ajit Khaparde
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231210012455.20229-9-ajit.khaparde@broadcom.com \
--to=ajit.khaparde@broadcom.com \
--cc=damodharam.ammepalli@broadcom.com \
--cc=dev@dpdk.org \
--cc=stable@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.