From mboxrd@z Thu Jan  1 00:00:00 1970
From: Bruce Richardson <bruce.richardson@intel.com>
Subject: Re: [PATCH v2 3/3] i40e: fix out-of-bounds access
Date: Tue, 5 Jul 2016 14:26:18 +0100
Message-ID: <20160705132618.GC23500@bricha3-MOBL3>
References: <1467272056-14388-1-git-send-email-beilei.xing@intel.com>
 <1467699005-16235-1-git-send-email-beilei.xing@intel.com>
 <1467699005-16235-4-git-send-email-beilei.xing@intel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: jingjing.wu@intel.com, michalx.k.jastrzebski@intel.com, dev@dpdk.org
To: Beilei Xing <beilei.xing@intel.com>
Return-path: <dev-bounces@dpdk.org>
Received: from mga03.intel.com (mga03.intel.com [134.134.136.65])
 by dpdk.org (Postfix) with ESMTP id 62A1A5922
 for <dev@dpdk.org>; Tue,  5 Jul 2016 15:26:23 +0200 (CEST)
Content-Disposition: inline
In-Reply-To: <1467699005-16235-4-git-send-email-beilei.xing@intel.com>
List-Id: patches and discussions about DPDK <dev.dpdk.org>
List-Unsubscribe: <http://dpdk.org/ml/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://dpdk.org/ml/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <http://dpdk.org/ml/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>

On Tue, Jul 05, 2016 at 02:10:05PM +0800, Beilei Xing wrote:
> When calling i40e_flowtype_to_pctype in
> i40e_get_hash_filter_global_config and
> i40e_set_hash_filter_global_config, function
> i40e_flowtype_to_pctype will be possibly
> out-of-bounds accessed, because size of callee's array
> is 15. So judge flow type before calling
> i40e_flowtype_to_pctype.
> Meanwhile do the same change in other functions.
> 
> Coverity issue: 37793, 37794
> 
> Fixes: 782c8c92f13f ("i40e: add hash configuration")
> Fixes: f2b2e2354bbd ("i40e: split function for hash and flow director input")
> Fixes: 98f055707685 ("i40e: configure input fields for RSS or flow director")
> 
> Signed-off-by: Beilei Xing <beilei.xing@intel.com>
> ---
>  drivers/net/i40e/i40e_ethdev.c | 21 ++++++++++++---------
>  1 file changed, 12 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c
> index a1cad37..111a552 100644
> --- a/drivers/net/i40e/i40e_ethdev.c
> +++ b/drivers/net/i40e/i40e_ethdev.c
> @@ -6908,6 +6908,9 @@ i40e_get_hash_filter_global_config(struct i40e_hw *hw,
>  		mask &= ~(1UL << i);
>  		/* Bit set indicats the coresponding flow type is supported */
>  		g_cfg->valid_bit_mask[0] |= (1UL << i);
> +		/* if flowtype is invalid, continue */
> +		if (!I40E_VALID_FLOW(i))
> +			continue;
>  		pctype = i40e_flowtype_to_pctype(i);
>  		reg = i40e_read_rx_ctl(hw, I40E_GLQF_HSYM(pctype));
>  		if (reg & I40E_GLQF_HSYM_SYMH_ENA_MASK)

Rather than having the same check done in multiple places, is there a reason
why we can't just put the check once in i40e_flowtype_to_pctype?

/Bruce