From: bugzilla@dpdk.org
To: dev@dpdk.org
Subject: [Bug 1146] bnx2x: rte_memcpy buffer overflows
Date: Fri, 09 Dec 2022 18:35:36 +0000 [thread overview]
Message-ID: <bug-1146-3@http.bugs.dpdk.org/> (raw)
https://bugs.dpdk.org/show_bug.cgi?id=1146
Bug ID: 1146
Summary: bnx2x: rte_memcpy buffer overflows
Product: DPDK
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: ethdev
Assignee: dev@dpdk.org
Reporter: mb@smartsharesystems.com
Target Milestone: ---
Test-Label: Intel-compilation
Test-Status: FAILURE
http://dpdk.org/patch/120440
_Compilation issues_
Submitter: Morten Brørup <mb@smartsharesystems.com>
Date: 2022-12-03 14:22:44
Reply_mail: <20221203142244.17135-1-mb@smartsharesystems.com>
DPDK git baseline: Repo:dpdk, CommitID:
6c8aed5ab7f6dbed8e71199504fa227f5f60c6fd
Meson Build Summary: 26 Builds Done, 23 Successful, 3 Failures, 0 Blocked
+--------------+------------+--------------+------------+------------+-----------+----------+------------+
| os | gcc-static | clang-static | icc-static | gcc-shared |
gcc-debug | document | gcc-16byte |
+--------------+------------+--------------+------------+------------+-----------+----------+------------+
| FC36-64 | fail | pass | | |
| | |
| FreeBSD13-64 | pass | pass | | pass | pass
| | |
| RHEL86-64 | pass | pass | | pass | pass
| | |
| SUSE15-64 | pass | pass | | |
| | |
| RHEL90-64 | pass | | | |
| | |
| UB2004-64 | pass | pass | | |
| pass | |
| UB2204-32 | pass | | | |
| | |
| UB2204-64 | pass | pass | | |
| pass | pass |
| CentOS79-64 | pass | | | |
| | |
| RHEL86-64Rt | pass | pass | | |
| | |
| UB2210-64 | fail | | | |
| | |
| FC37-64 | fail | | | |
| | |
+--------------+------------+--------------+------------+------------+-----------+----------+------------+
Comments:
Because of DPDK bug (https://bugs.dpdk.org/show_bug.cgi?id=928),
All the dpdk-next-* branch add `Ddisable_drivers=event/cnxk` option when build
with ICC complier.
Test environment and configuration as below:
OS: FC36-64
Kernel Version: 5.17.7-300.fc36.x86_64
GCC Version: gcc (GCC) 12.1.1 20220507 (Red Hat 12.1.1-1)
Clang Version: 14.0.0 (Fedora 14.0.0-1.fc36)
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-clang
OS: FreeBSD13-64
Kernel Version: 13.1-RELEASE
GCC Version: gcc (FreeBSD Ports Collection) 10.3.0
Clang Version: 13.0.0 (git@github.com:llvm/llvm-project.git
llvmorg-13.0.0-0-gd7b669b3a303)
x86_64-native-bsdapp-gcc
x86_64-native-bsdapp-clang
x86_64-native-bsdapp-gcc+shared
x86_64-native-bsdapp-gcc+debug
OS: RHEL86-64
Kernel Version: 4.18.0-372.9.1.el8.x86_64
GCC Version: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-13)
Clang Version: 14.0.0 (Red Hat 14.0.0-1.module_el8.7.0+1142+5343df54)
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-clang
x86_64-native-linuxapp-gcc+shared
x86_64-native-linuxapp-gcc+debug
OS: SUSE15-64
Kernel Version: 5.14.21-150400.22-default
GCC Version: gcc (SUSE Linux) 7.5.0
Clang Version: 11.0.1
x86_64-native-linuxapp-clang
x86_64-native-linuxapp-gcc
OS: RHEL90-64
Kernel Version: 5.14.0-70.13.1.el9_0.x86_64
GCC Version: gcc (GCC) 11.2.1 20220127 (Red Hat 11.2.1-9)
Clang Version: 13.0.1 (Red Hat 13.0.1-1.el9)
x86_64-native-linuxapp-gcc
OS: UB2004-64
Kernel Version: 5.8.0-48-generic
GCC Version: gcc (Ubuntu 10.3.0-1ubuntu1~20.04) 10.3.0
Clang Version: 10.0.0-4ubuntu1
x86_64-native-linuxapp-clang
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-doc
OS: UB2204-32
Kernel Version: 5.15.0-25-generic
GCC Version: gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0
Clang Version: NA
i686-native-linuxapp-gcc
OS: UB2204-64
Kernel Version: 5.15.0-25-generic
GCC Version: gcc (Ubuntu 11.2.0-19ubuntu1) 11.2.0
Clang Version: 14.0.0-1ubuntu1
x86_64-native-linuxapp-gcc+16byte
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-clang
x86_64-native-linuxapp-doc
OS: CentOS79-64
Kernel Version: 3.10.0-1160.76.1.el7.x86_64
GCC Version: gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-44)
Clang Version: 3.4.2 (tags/RELEASE_34/dot2-final)
x86_64-native-linuxapp-gcc
OS: RHEL86-64Rt
Kernel Version: 4.18.0-372.9.1.rt7.166.el8.x86_64
GCC Version: gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-13)
Clang Version: 14.0.0 (Red Hat 14.0.0-1.module_el8.7.0+1142+5343df54)
x86_64-native-linuxapp-gcc
x86_64-native-linuxapp-clang
OS: UB2210-64
Kernel Version: 5.19.0-21-generic
GCC Version: gcc (Ubuntu 12.2.0-3ubuntu1) 12.2.0
Clang Version: 15.0.2-1
x86_64-native-linuxapp-gcc
OS: FC37-64
Kernel Version: 6.0.7-301.fc37.x86_64
GCC Version: gcc (GCC) 12.2.1 20220819 (Red Hat 12.2.1-2)
Clang Version: 15.0.4 (Fedora 15.0.4-1.fc37)
x86_64-native-linuxapp-gcc
*Build Failed #1:
OS: FC36-64
Target: x86_64-native-linuxapp-gcc
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -c
../drivers/net/bnx2x/bnx2x_vfpf.c
../drivers/net/bnx2x/bnx2x_vfpf.c: In function ‘bnx2x_check_bull’:
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ writing 4 bytes
into a region of size 2 overflows the destination [-Werror=stringop-overflow=]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:29,
from ../drivers/net/bnx2x/bnx2x_vfpf.c:8:
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: destination object ‘vlan’ of
size 2
297 | uint16_t vlan;
| ^~~~
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ reading 4 bytes
from a region of size 2 [-Werror=stringop-overread]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: source object ‘vlan’ of size 2
297 | uint16_t vlan;
| ^~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[975/3225] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_filter.c.o
[976/3225] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_cpr.c.o
[977/3225] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_ecore_sp.c.o
[978/3225] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -c
../drivers/net/bnx2x/bnx2x_stats.c
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_hw_stats_update’:
../drivers/net/bnx2x/bnx2x_stats.c:822:5: error: ‘rte_memcpy’ writing 304 bytes
into a region of size 4 overflows the destination [-Werror=stringop-overflow=]
822 | rte_memcpy(&(estats->rx_stat_ifhcinbadoctets_hi),
&(pstats->mac_stx[1]),
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
823 | sizeof(struct mac_stx));
| ~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:28,
from ../drivers/net/bnx2x/bnx2x_stats.c:14:
../drivers/net/bnx2x/bnx2x_stats.h:82:14: note: destination object
‘rx_stat_ifhcinbadoctets_hi’ of size 4
82 | uint32_t rx_stat_ifhcinbadoctets_hi;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_stats_init’:
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1494:17: note: in expansion of macro
‘REG_RD_DMAE’
1494 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT0 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:34:14: note: destination object
‘egress_mac_pkt0_lo’ of size 4
34 | uint32_t egress_mac_pkt0_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1496:17: note: in expansion of macro
‘REG_RD_DMAE’
1496 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT1 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:36:14: note: destination object
‘egress_mac_pkt1_lo’ of size 4
36 | uint32_t egress_mac_pkt1_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[979/3225] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_ethdev.c.o
[980/3225] Generating drivers/rte_common_sfc_efx.sym_chk with a custom command
(wrapped by meson to capture output)
[981/3225] Generating drivers/rte_common_cnxk.sym_chk with a custom command
(wrapped by meson to capture output)
[982/3225] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x.c.o
[983/3225] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_elink.c.o
ninja: build stopped
*Build Failed #2:
OS: UB2210-64
Target: x86_64-native-linuxapp-gcc
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -c
../drivers/net/bnx2x/bnx2x_vfpf.c
../drivers/net/bnx2x/bnx2x_vfpf.c: In function ‘bnx2x_check_bull’:
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ writing 4 bytes
into a region of size 2 overflows the destination [-Werror=stringop-overflow=]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:29,
from ../drivers/net/bnx2x/bnx2x_vfpf.c:8:
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: destination object ‘vlan’ of
size 2
297 | uint16_t vlan;
| ^~~~
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ reading 4 bytes
from a region of size 2 [-Werror=stringop-overread]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: source object ‘vlan’ of size 2
297 | uint16_t vlan;
| ^~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[965/3242] Generating drivers/rte_net_axgbe.pmd.c with a custom command
[966/3242] Generating drivers/rte_common_sfc_efx.sym_chk with a custom command
(wrapped by meson to capture output)
[967/3242] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_cpr.c.o
[968/3242] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_filter.c.o
[969/3242] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -c
../drivers/net/bnx2x/bnx2x_stats.c
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_hw_stats_update’:
../drivers/net/bnx2x/bnx2x_stats.c:822:5: error: ‘rte_memcpy’ writing 304 bytes
into a region of size 4 overflows the destination [-Werror=stringop-overflow=]
822 | rte_memcpy(&(estats->rx_stat_ifhcinbadoctets_hi),
&(pstats->mac_stx[1]),
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
823 | sizeof(struct mac_stx));
| ~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:28,
from ../drivers/net/bnx2x/bnx2x_stats.c:14:
../drivers/net/bnx2x/bnx2x_stats.h:82:14: note: destination object
‘rx_stat_ifhcinbadoctets_hi’ of size 4
82 | uint32_t rx_stat_ifhcinbadoctets_hi;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_stats_init’:
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1494:17: note: in expansion of macro
‘REG_RD_DMAE’
1494 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT0 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:34:14: note: destination object
‘egress_mac_pkt0_lo’ of size 4
34 | uint32_t egress_mac_pkt0_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1496:17: note: in expansion of macro
‘REG_RD_DMAE’
1496 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT1 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:36:14: note: destination object
‘egress_mac_pkt1_lo’ of size 4
36 | uint32_t egress_mac_pkt1_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[970/3242] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_ecore_sp.c.o
[971/3242] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_ethdev.c.o
[972/3242] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x.c.o
[973/3242] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_elink.c.o
ninja: build stopped
*Build Failed #3:
OS: FC37-64
Target: x86_64-native-linuxapp-gcc
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_vfpf.c.o -c
../drivers/net/bnx2x/bnx2x_vfpf.c
../drivers/net/bnx2x/bnx2x_vfpf.c: In function ‘bnx2x_check_bull’:
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ writing 4 bytes
into a region of size 2 overflows the destination [-Werror=stringop-overflow=]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:29,
from ../drivers/net/bnx2x/bnx2x_vfpf.c:8:
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: destination object ‘vlan’ of
size 2
297 | uint16_t vlan;
| ^~~~
../drivers/net/bnx2x/bnx2x_vfpf.c:57:17: error: ‘rte_memcpy’ reading 4 bytes
from a region of size 2 [-Werror=stringop-overread]
57 | rte_memcpy(&bull->vlan, &sc->old_bulletin.vlan,
RTE_VLAN_HLEN);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_vfpf.h:297:18: note: source object ‘vlan’ of size 2
297 | uint16_t vlan;
| ^~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[974/3192] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_filter.c.o
[975/3192] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
FAILED: drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o
gcc -Idrivers/libtmp_rte_net_bnx2x.a.p -Idrivers -I../drivers
-Idrivers/net/bnx2x -I../drivers/net/bnx2x -Ilib/ethdev -I../lib/ethdev -I.
-I.. -Iconfig -I../config -Ilib/eal/include -I../lib/eal/include
-Ilib/eal/linux/include -I../lib/eal/linux/include -Ilib/eal/x86/include
-I../lib/eal/x86/include -Ilib/eal/common -I../lib/eal/common -Ilib/eal
-I../lib/eal -Ilib/kvargs -I../lib/kvargs -Ilib/metrics -I../lib/metrics
-Ilib/telemetry -I../lib/telemetry -Ilib/net -I../lib/net -Ilib/mbuf
-I../lib/mbuf -Ilib/mempool -I../lib/mempool -Ilib/ring -I../lib/ring
-Ilib/meter -I../lib/meter -Idrivers/bus/pci -I../drivers/bus/pci
-I../drivers/bus/pci/linux -Ilib/pci -I../lib/pci -Idrivers/bus/vdev
-I../drivers/bus/vdev -fdiagnostics-color=always -D_FILE_OFFSET_BITS=64 -Wall
-Winvalid-pch -Wextra -Werror -O3 -include rte_config.h -Wcast-qual
-Wdeprecated -Wformat -Wformat-nonliteral -Wformat-security
-Wmissing-declarations -Wmissing-prototypes -Wnested-externs
-Wold-style-definition -Wpointer-arith -Wsign-compare -Wstrict-prototypes
-Wundef -Wwrite-strings -Wno-address-of-packed-member -Wno-packed-not-aligned
-Wno-missing-field-initializers -Wno-zero-length-bounds -D_GNU_SOURCE -fPIC
-march=native -DALLOW_EXPERIMENTAL_API -DALLOW_INTERNAL_API
-Wno-format-truncation -DZLIB_CONST -DRTE_LOG_DEFAULT_LOGTYPE=pmd.net.bnx2x -MD
-MQ drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -MF
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o.d -o
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x_stats.c.o -c
../drivers/net/bnx2x/bnx2x_stats.c
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_hw_stats_update’:
../drivers/net/bnx2x/bnx2x_stats.c:822:5: error: ‘rte_memcpy’ writing 304 bytes
into a region of size 4 overflows the destination [-Werror=stringop-overflow=]
822 | rte_memcpy(&(estats->rx_stat_ifhcinbadoctets_hi),
&(pstats->mac_stx[1]),
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
823 | sizeof(struct mac_stx));
| ~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../drivers/net/bnx2x/bnx2x.h:28,
from ../drivers/net/bnx2x/bnx2x_stats.c:14:
../drivers/net/bnx2x/bnx2x_stats.h:82:14: note: destination object
‘rx_stat_ifhcinbadoctets_hi’ of size 4
82 | uint32_t rx_stat_ifhcinbadoctets_hi;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../lib/mempool/rte_mempool.h:48,
from ../lib/mbuf/rte_mbuf.h:38,
from ../lib/net/rte_ether.h:22,
from ../lib/ethdev/rte_eth_ctrl.h:10,
from ../lib/ethdev/rte_ethdev.h:1419,
from ../lib/ethdev/ethdev_driver.h:24,
from ../drivers/net/bnx2x/bnx2x_ethdev.h:34,
from ../drivers/net/bnx2x/bnx2x.h:23:
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c: In function ‘bnx2x_stats_init’:
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1494:17: note: in expansion of macro
‘REG_RD_DMAE’
1494 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT0 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:34:14: note: destination object
‘egress_mac_pkt0_lo’ of size 4
34 | uint32_t egress_mac_pkt0_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
../drivers/net/bnx2x/bnx2x.h:1545:9: error: ‘rte_memcpy’ writing 8 bytes into a
region of size 4 overflows the destination [-Werror=stringop-overflow=]
1545 | rte_memcpy(valp, BNX2X_SP(sc, wb_data[0]), (len32) * 4); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.c:1496:17: note: in expansion of macro
‘REG_RD_DMAE’
1496 | REG_RD_DMAE(sc, NIG_REG_STAT0_EGRESS_MAC_PKT1 +
port*0x50,
| ^~~~~~~~~~~
../drivers/net/bnx2x/bnx2x_stats.h:36:14: note: destination object
‘egress_mac_pkt1_lo’ of size 4
36 | uint32_t egress_mac_pkt1_lo;
| ^~~~~~~~~~~~~~~~~~
../lib/eal/x86/include/rte_memcpy.h:869:1: note: in a call to function
‘rte_memcpy’ declared with attribute ‘access (read_only, 2, 3)’
869 | rte_memcpy(void *dst, const void *src, size_t n)
| ^~~~~~~~~~
cc1: all warnings being treated as errors
[976/3192] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_rxq.c.o
[977/3192] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_ecore_sp.c.o
[978/3192] Compiling C object
drivers/libtmp_rte_net_bnxt.a.p/net_bnxt_bnxt_ethdev.c.o
[979/3192] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_bnx2x.c.o
[980/3192] Compiling C object
drivers/libtmp_rte_net_bnx2x.a.p/net_bnx2x_elink.c.o
[981/3192] Generating drivers/rte_common_sfc_efx.sym_chk with a custom command
(wrapped by meson to capture output)
[982/3192] Generating drivers/rte_common_cnxk.sym_chk with a custom command
(wrapped by meson to capture output)
ninja: build stopped
DPDK STV team
--
You are receiving this mail because:
You are the assignee for the bug.
next reply other threads:[~2022-12-09 18:35 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-09 18:35 bugzilla [this message]
2024-03-18 0:49 ` [DPDK/ethdev Bug 1146] bnx2x: rte_memcpy buffer overflows bugzilla
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-1146-3@http.bugs.dpdk.org/ \
--to=bugzilla@dpdk.org \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.