[dpdk-dev] [PATCH v2] net/softnic: fix out of bound access

Dumitrescu, Cristian cristian.dumitrescu at intel.com
Mon Oct 19 15:16:43 CEST 2020



> -----Original Message-----
> From: Dharmappa, Savinay <savinay.dharmappa at intel.com>
> Sent: Monday, October 19, 2020 12:52 PM
> To: Dumitrescu, Cristian <cristian.dumitrescu at intel.com>; Singh, Jasvinder
> <jasvinder.singh at intel.com>; dev at dpdk.org
> Cc: Dharmappa, Savinay <savinay.dharmappa at intel.com>
> Subject: [PATCH v2] net/softnic: fix out of bound access
> 
> This patch fixes out of bound access of an array.
> 
> Coverity issue: 363466, 363459
> Fixes: b5dfa6703d49 ("net/softnic: update subport rate dynamically")
> 
> Signed-off-by: Savinay Dharmappa <savinay.dharmappa at intel.com>
> ---
> v2: addressed review comments of v1
> ---
>  drivers/net/softnic/rte_eth_softnic_tm.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/softnic/rte_eth_softnic_tm.c
> b/drivers/net/softnic/rte_eth_softnic_tm.c
> index 725b0231ae..90baba15ce 100644
> --- a/drivers/net/softnic/rte_eth_softnic_tm.c
> +++ b/drivers/net/softnic/rte_eth_softnic_tm.c
> @@ -1147,10 +1147,15 @@ update_subport_tc_rate(struct rte_eth_dev
> *dev,
>  	struct tm_node *ns = np->parent_node;
>  	uint32_t subport_id = tm_node_subport_id(dev, ns);
>  	struct tm_params *t = &p->soft.tm.params;
> -	uint32_t subport_profile_id = t->subport_to_profile[subport_id];
> +	uint32_t subport_profile_id;
>  	struct tm_shaper_profile *sp_old = tm_shaper_profile_search(dev,
>  		ss->shaper_profile_id);
> 
> +	if (subport_id >= TM_MAX_SUBPORT_PROFILE)
> +		return -1;
> +
> +	subport_profile_id = t->subport_to_profile[subport_id];
> +
>  	/* Derive new subport configuration. */
>  	memcpy(&subport_profile,
>  		&p->soft.tm.params.subport_profile[subport_profile_id],
> @@ -2370,6 +2375,9 @@ subport_profile_get(struct rte_eth_dev *dev,
> struct tm_node *np)
>  	struct tm_params *t = &p->soft.tm.params;
>  	uint32_t subport_id = tm_node_subport_id(dev, np->parent_node);
> 
> +	if (subport_id >= TM_MAX_SUBPORT_PROFILE)
> +		return NULL;
> +
>  	return &t->subport_profile[subport_id];
>  }
> 
> @@ -3024,6 +3032,9 @@ update_subport_rate(struct rte_eth_dev *dev,
>  	struct rte_sched_subport_profile_params profile1;
>  	uint32_t subport_profile_id;
> 
> +	if (profile0 == NULL)
> +		return -1;
> +
>  	/* Derive new pipe profile. */
>  	memcpy(&profile1, profile0, sizeof(profile1));
>  	profile1.tb_rate = sp->params.peak.rate;
> --
> 2.17.1

Acked-by: Cristian Dumitrescu <cristian.dumitrescu at intel.com>



More information about the dev mailing list