[dpdk-dev] [PATCH v10 06/19] eal: support attach or detach share device from secondary

[Burakov, Anatoly]

On 09-Jul-18 4:36 AM, Qi Zhang wrote:
> This patch cover the multi-process hotplug case when a device
> attach/detach request be issued from a secondary process
> 
> device attach on secondary:
> a) secondary send sync request to the primary.
> b) primary receive the request and attach the new device if
>     failed goto i).
> c) primary forward attach sync request to all secondary.
> d) secondary receive the request and attach the device and send a reply.
> e) primary check the reply if all success goes to j).
> f) primary send attach rollback sync request to all secondary.
> g) secondary receive the request and detach the device and send a reply.
> h) primary receive the reply and detach device as rollback action.
> i) send attach fail to secondary as a reply of step a), goto k).
> j) send attach success to secondary as a reply of step a).
> k) secondary receive reply and return.
> 
> device detach on secondary:
> a) secondary send sync request to the primary.
> b) primary send detach sync request to all secondary.
> c) secondary detach the device and send a reply.
> d) primary check the reply if all success goes to g).
> e) primary send detach rollback sync request to all secondary.
> f) secondary receive the request and attach back device. goto h).
> g) primary detach the device if success goto i), else goto e).
> h) primary send detach fail to secondary as a reply of step a), goto j).
> i) primary send detach success to secondary as a reply of step a).
> j) secondary receive reply and return.
> 
> Signed-off-by: Qi Zhang <qi.z.zhang at intel.com>
> ---

<snip>

> +
> +	memset(&mp_req, 0, sizeof(mp_req));
> +	memcpy(mp_req.param, req, sizeof(*req));
> +	mp_req.len_param = sizeof(*req);
> +	strlcpy(mp_req.name, EAL_DEV_MP_ACTION_REQUEST, sizeof(mp_req.name));
> +
> +	ret = rte_mp_request_sync(&mp_req, &mp_reply, &ts);
> +	if (ret) {
> +		RTE_LOG(ERR, EAL, "cannot send request to primary");
> +		return ret;
> +	}
> +
> +	resp = (struct eal_dev_mp_req *)mp_reply.msgs[0].param;

This looks like a potential buffer overflow - you don't check if there's 
a first message to read a response from.

> +	req->result = resp->result;
> +
> +	return ret;
>   }
>   
>   int eal_dev_hotplug_request_to_secondary(struct eal_dev_mp_req *req)
> 


-- 
Thanks,
Anatoly