[PATCH v4] net/zxdh: Provided zxdh basic init

Stephen Hemminger stephen at networkplumber.org
Thu Dec 19 23:38:45 CET 2024


On Tue, 10 Sep 2024 20:00:20 +0800
Junlong Wang <wang.junlong1 at zte.com.cn> wrote:

> provided zxdh initialization of zxdh PMD driver.
> include msg channel, np init and etc.
> 
> Signed-off-by: Junlong Wang <wang.junlong1 at zte.com.cn>
> ---
> V4: Resolve compilation issues
> V3: Resolve compilation issues
> V2: Resolve compilation issues and modify doc(zxdh.ini zdh.rst)
> V1: Provide zxdh basic init and open source NPSDK lib
> ---

Overall this looks good, one test checklist item for me was to build
with Gcc 14 and analyzer option. This finds bugs but can generate false
positives.  The output is quite verbose.

It complains about this which may or may not be a real problem.
If memcpy() is used instead of rte_memcpy() then the problem goes away.
The issue is that inlined version rte_memcpy() will reference past the arguments
as an internal optimization for small values.

[1564/3222] Compiling C object drivers/libtmp_rte_net_zxdh.a.p/net_zxdh_zxdh_common.c.o
In file included from ../lib/mempool/rte_mempool.h:50,
                 from ../lib/mbuf/rte_mbuf.h:38,
                 from ../lib/net/rte_ether.h:20,
                 from ../lib/ethdev/rte_eth_ctrl.h:10,
                 from ../lib/ethdev/rte_ethdev.h:1472,
                 from ../lib/ethdev/ethdev_driver.h:21,
                 from ../drivers/net/zxdh/zxdh_common.c:8:
In function ‘rte_mov15_or_less’,
    inlined from ‘rte_memcpy_generic’ at ../lib/eal/x86/include/rte_memcpy.h:395:10,
    inlined from ‘rte_memcpy’ at ../lib/eal/x86/include/rte_memcpy.h:757:10,
    inlined from ‘zxdh_get_res_info’ at ../drivers/net/zxdh/zxdh_common.c:231:2:
../lib/eal/x86/include/rte_memcpy.h:82:55: warning: stack-based buffer overflow [CWE-121] [-Wanalyzer-out-of-bounds]
   82 |                 ((struct rte_uint64_alias *)dst)->val =
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
   83 |                         ((const struct rte_uint64_alias *)src)->val;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘zxdh_panelid_get’: events 1-3
    |
    |../drivers/net/zxdh/zxdh_common.c:250:1:
    |  239 |         uint8_t reps = 0;
    |      |                 ~~~~
    |      |                 |
    |      |                 (2) capacity: 1 byte
    |......
    |  250 | zxdh_panelid_get(struct rte_eth_dev *dev, uint8_t *panelid)
    |      | ^~~~~~~~~~~~~~~~
    |      | |
    |      | (1) entry to ‘zxdh_panelid_get’
    |......
    |  255 |         int32_t ret = zxdh_get_res_panel_id(&param, panelid);
    |      |                       ~
    |      |                       |
    |      |                       (3) inlined call to ‘zxdh_get_res_panel_id’ from ‘zxdh_panelid_get’
    |
    +--> ‘zxdh_get_res_panel_id’: event 4
           |
           |  242 |         if (zxdh_get_res_info(in, ZXDH_TBL_FIELD_PNLID, &reps, &reps_len) != ZXDH_BAR_MSG_OK)
           |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |             |
           |      |             (4) calling ‘zxdh_get_res_info’ from ‘zxdh_panelid_get’
           |
         ‘zxdh_get_res_info’: events 5-12
           |
           |  186 | zxdh_get_res_info(struct zxdh_res_para *dev, uint8_t field, uint8_t *res, uint16_t *len)
           |      | ^~~~~~~~~~~~~~~~~
           |      | |
           |      | (5) entry to ‘zxdh_get_res_info’
           |......
           |  192 |         if (!res || !dev)
           |      |            ~
           |      |            |
           |      |            (6) following ‘false’ branch...
           |......
           |  195 |         struct zxdh_tbl_msg_header tbl_msg = {
           |      |                                    ~~~~~~~
           |      |                                    |
           |      |                                    (7) ...to here
           |......
           |  217 |         if (ret != ZXDH_BAR_MSG_OK) {
           |      |            ~
           |      |            |
           |      |            (8) following ‘false’ branch (when ‘ret == 0’)...
           |......
           |  225 |         if (tbl_reps->check != ZXDH_TBL_MSG_PRO_SUCCESS) {
           |      |            ~~~~~~~~~~~~~~~~
           |      |            |        |
           |      |            |        (9) ...to here
           |      |            (10) following ‘false’ branch...
           |......
           |  230 |         *len = tbl_reps->len;
           |      |                ~~~~~~~~~~~~~
           |      |                        |
           |      |                        (11) ...to here
           |  231 |         rte_memcpy(res, (recv_buf + ZXDH_REPS_HEADER_OFFSET +
           |      |         ~
           |      |         |
           |      |         (12) inlined call to ‘rte_memcpy’ from ‘zxdh_get_res_info’
           |
           +--> ‘rte_memcpy’: events 13-14
                  |
                  |../lib/eal/x86/include/rte_memcpy.h:754:12:
                  |  754 |         if (!(((uintptr_t)dst | (uintptr_t)src) & ALIGNMENT_MASK))
                  |      |            ^
                  |      |            |
                  |      |            (13) following ‘false’ branch...
                  |......
                  |  757 |                 return rte_memcpy_generic(dst, src, n);
                  |      |                        ~
                  |      |                        |
                  |      |                        (14) inlined call to ‘rte_memcpy_generic’ from ‘rte_memcpy’
                  |
                  +--> ‘rte_memcpy_generic’: events 15-17
                         |
                         |  394 |         if (n < 16) {
                         |      |            ^
                         |      |            |
                         |      |            (15) ...to here
                         |      |            (16) following ‘true’ branch...
                         |  395 |                 return rte_mov15_or_less(dst, src, n);
                         |      |                        ~
                         |      |                        |
                         |      |                        (17) inlined call to ‘rte_mov15_or_less’ from ‘rte_memcpy_generic’
                         |
                         +--> ‘rte_mov15_or_less’: events 18-21
                                |
                                |   81 |         if (n & 8) {
                                |      |            ^
                                |      |            |
                                |      |            (18) ...to here
                                |      |            (19) following ‘true’ branch...
                                |   82 |                 ((struct rte_uint64_alias *)dst)->val =
                                |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                                                       |
                                |      |                                                       (21) out-of-bounds write from byte 1 till byte 7 but ‘reps’ ends at byte 1
                                |   83 |                         ((const struct rte_uint64_alias *)src)->val;
                                |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                                                               |
                                |      |                                                               (20) ...to here
                                |
../lib/eal/x86/include/rte_memcpy.h:82:55: note: write of 7 bytes to beyond the end of ‘reps’
   82 |                 ((struct rte_uint64_alias *)dst)->val =
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
   83 |                         ((const struct rte_uint64_alias *)src)->val;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  ┌──────────────────────────────────────────────────────────────────────┐
  │                    write of ‘uint64_t’ (8 bytes)                     │
  └──────────────────────────────────────────────────────────────────────┘
              │                                   │
              │                                   │
              v                                   v
  ┌────────────────────────┐┌────────────────────────────────────────────┐
  │‘reps’ (type: ‘uint8_t’)││             after valid range              │
  └────────────────────────┘└────────────────────────────────────────────┘
  ├───────────┬────────────┤├─────────────────────┬──────────────────────┤
              │                                   │
     ╭────────┴───────╮               ╭───────────┴──────────╮
     │capacity: 1 byte│               │⚠️  overflow of 7 bytes│
     ╰────────────────╯               ╰──────────────────────╯

In function ‘rte_mov15_or_less’,
    inlined from ‘rte_memcpy_aligned’ at ../lib/eal/x86/include/rte_memcpy.h:706:10,
    inlined from ‘rte_memcpy’ at ../lib/eal/x86/include/rte_memcpy.h:755:10,
    inlined from ‘zxdh_get_res_info’ at ../drivers/net/zxdh/zxdh_common.c:231:2:
../lib/eal/x86/include/rte_memcpy.h:82:55: warning: stack-based buffer overflow [CWE-121] [-Wanalyzer-out-of-bounds]
   82 |                 ((struct rte_uint64_alias *)dst)->val =
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
   83 |                         ((const struct rte_uint64_alias *)src)->val;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘zxdh_hashidx_get’: events 1-3
    |
    |../drivers/net/zxdh/zxdh_common.c:273:1:
    |  262 |         uint8_t reps = 0;
    |      |                 ~~~~
    |      |                 |
    |      |                 (2) capacity: 1 byte
    |......
    |  273 | zxdh_hashidx_get(struct rte_eth_dev *dev, uint8_t *hash_idx)
    |      | ^~~~~~~~~~~~~~~~
    |      | |
    |      | (1) entry to ‘zxdh_hashidx_get’
    |......
    |  278 |         int32_t ret = zxdh_get_res_hash_id(&param, hash_idx);
    |      |                       ~
    |      |                       |
    |      |                       (3) inlined call to ‘zxdh_get_res_hash_id’ from ‘zxdh_hashidx_get’
    |
    +--> ‘zxdh_get_res_hash_id’: event 4
           |
           |  265 |         if (zxdh_get_res_info(in, ZXDH_TBL_FIELD_HASHID, &reps, &reps_len) != ZXDH_BAR_MSG_OK)
           |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |             |
           |      |             (4) calling ‘zxdh_get_res_info’ from ‘zxdh_hashidx_get’
           |
         ‘zxdh_get_res_info’: events 5-12
           |
           |  186 | zxdh_get_res_info(struct zxdh_res_para *dev, uint8_t field, uint8_t *res, uint16_t *len)
           |      | ^~~~~~~~~~~~~~~~~
           |      | |
           |      | (5) entry to ‘zxdh_get_res_info’
           |......
           |  192 |         if (!res || !dev)
           |      |            ~
           |      |            |
           |      |            (6) following ‘false’ branch...
           |......
           |  195 |         struct zxdh_tbl_msg_header tbl_msg = {
           |      |                                    ~~~~~~~
           |      |                                    |
           |      |                                    (7) ...to here
           |......
           |  217 |         if (ret != ZXDH_BAR_MSG_OK) {
           |      |            ~
           |      |            |
           |      |            (8) following ‘false’ branch (when ‘ret == 0’)...
           |......
           |  225 |         if (tbl_reps->check != ZXDH_TBL_MSG_PRO_SUCCESS) {
           |      |            ~~~~~~~~~~~~~~~~
           |      |            |        |
           |      |            |        (9) ...to here
           |      |            (10) following ‘false’ branch...
           |......
           |  230 |         *len = tbl_reps->len;
           |      |                ~~~~~~~~~~~~~
           |      |                        |
           |      |                        (11) ...to here
           |  231 |         rte_memcpy(res, (recv_buf + ZXDH_REPS_HEADER_OFFSET +
           |      |         ~
           |      |         |
           |      |         (12) inlined call to ‘rte_memcpy’ from ‘zxdh_get_res_info’
           |
           +--> ‘rte_memcpy’: events 13-14
                  |
                  |../lib/eal/x86/include/rte_memcpy.h:754:12:
                  |  754 |         if (!(((uintptr_t)dst | (uintptr_t)src) & ALIGNMENT_MASK))
                  |      |            ^
                  |      |            |
                  |      |            (13) following ‘true’ branch...
                  |  755 |                 return rte_memcpy_aligned(dst, src, n);
                  |      |                        ~
                  |      |                        |
                  |      |                        (14) inlined call to ‘rte_memcpy_aligned’ from ‘rte_memcpy’
                  |
                  +--> ‘rte_memcpy_aligned’: events 15-17
                         |
                         |  705 |         if (n < 16) {
                         |      |            ^
                         |      |            |
                         |      |            (15) ...to here
                         |      |            (16) following ‘true’ branch...
                         |  706 |                 return rte_mov15_or_less(dst, src, n);
                         |      |                        ~
                         |      |                        |
                         |      |                        (17) inlined call to ‘rte_mov15_or_less’ from ‘rte_memcpy_aligned’
                         |
                         +--> ‘rte_mov15_or_less’: events 18-21
                                |
                                |   81 |         if (n & 8) {
                                |      |            ^
                                |      |            |
                                |      |            (18) ...to here
                                |      |            (19) following ‘true’ branch...
                                |   82 |                 ((struct rte_uint64_alias *)dst)->val =
                                |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                                                       |
                                |      |                                                       (21) out-of-bounds write from byte 1 till byte 7 but ‘reps’ ends at byte 1
                                |   83 |                         ((const struct rte_uint64_alias *)src)->val;
                                |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                                                               |
                                |      |                                                               (20) ...to here
                                |
../lib/eal/x86/include/rte_memcpy.h:82:55: note: write of 7 bytes to beyond the end of ‘reps’
   82 |                 ((struct rte_uint64_alias *)dst)->val =
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
   83 |                         ((const struct rte_uint64_alias *)src)->val;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  ┌──────────────────────────────────────────────────────────────────────┐
  │                    write of ‘uint64_t’ (8 bytes)                     │
  └──────────────────────────────────────────────────────────────────────┘
              │                                   │
              │                                   │
              v                                   v
  ┌────────────────────────┐┌────────────────────────────────────────────┐
  │‘reps’ (type: ‘uint8_t’)││             after valid range              │
  └────────────────────────┘└────────────────────────────────────────────┘
  ├───────────┬────────────┤├─────────────────────┬──────────────────────┤
              │                                   │
     ╭────────┴───────╮               ╭───────────┴──────────╮
     │capacity: 1 byte│               │⚠️  overflow of 7 bytes│
     ╰────────────────╯               ╰──────────────────────╯

../lib/eal/x86/include/rte_memcpy.h:82:55: warning: stack-based buffer overflow [CWE-121] [-Wanalyzer-out-of-bounds]
  ‘zxdh_panelid_get’: events 1-3
    |
    |../drivers/net/zxdh/zxdh_common.c:250:1:
    |  239 |         uint8_t reps = 0;
    |      |                 ~~~~
    |      |                 |
    |      |                 (2) capacity: 1 byte
    |......
    |  250 | zxdh_panelid_get(struct rte_eth_dev *dev, uint8_t *panelid)
    |      | ^~~~~~~~~~~~~~~~
    |      | |
    |      | (1) entry to ‘zxdh_panelid_get’
    |......
    |  255 |         int32_t ret = zxdh_get_res_panel_id(&param, panelid);
    |      |                       ~
    |      |                       |
    |      |                       (3) inlined call to ‘zxdh_get_res_panel_id’ from ‘zxdh_panelid_get’
    |
    +--> ‘zxdh_get_res_panel_id’: event 4
           |
           |  242 |         if (zxdh_get_res_info(in, ZXDH_TBL_FIELD_PNLID, &reps, &reps_len) != ZXDH_BAR_MSG_OK)
           |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |             |
           |      |             (4) calling ‘zxdh_get_res_info’ from ‘zxdh_panelid_get’
           |
         ‘zxdh_get_res_info’: events 5-12
           |
           |  186 | zxdh_get_res_info(struct zxdh_res_para *dev, uint8_t field, uint8_t *res, uint16_t *len)
           |      | ^~~~~~~~~~~~~~~~~
           |      | |
           |      | (5) entry to ‘zxdh_get_res_info’
           |......
           |  192 |         if (!res || !dev)
           |      |            ~
           |      |            |
           |      |            (6) following ‘false’ branch...
           |......
           |  195 |         struct zxdh_tbl_msg_header tbl_msg = {
           |      |                                    ~~~~~~~
           |      |                                    |
           |      |                                    (7) ...to here
           |......
           |  217 |         if (ret != ZXDH_BAR_MSG_OK) {
           |      |            ~
           |      |            |
           |      |            (8) following ‘false’ branch (when ‘ret == 0’)...
           |......
           |  225 |         if (tbl_reps->check != ZXDH_TBL_MSG_PRO_SUCCESS) {
           |      |            ~~~~~~~~~~~~~~~~
           |      |            |        |
           |      |            |        (9) ...to here
           |      |            (10) following ‘false’ branch...
           |......
           |  230 |         *len = tbl_reps->len;
           |      |                ~~~~~~~~~~~~~
           |      |                        |
           |      |                        (11) ...to here
           |  231 |         rte_memcpy(res, (recv_buf + ZXDH_REPS_HEADER_OFFSET +
           |      |         ~
           |      |         |
           |      |         (12) inlined call to ‘rte_memcpy’ from ‘zxdh_get_res_info’
           |
           +--> ‘rte_memcpy’: events 13-14
                  |
                  |../lib/eal/x86/include/rte_memcpy.h:754:12:
                  |  754 |         if (!(((uintptr_t)dst | (uintptr_t)src) & ALIGNMENT_MASK))
                  |      |            ^
                  |      |            |
                  |      |            (13) following ‘true’ branch...
                  |  755 |                 return rte_memcpy_aligned(dst, src, n);
                  |      |                        ~
                  |      |                        |
                  |      |                        (14) inlined call to ‘rte_memcpy_aligned’ from ‘rte_memcpy’
                  |
                  +--> ‘rte_memcpy_aligned’: events 15-17
                         |
                         |  705 |         if (n < 16) {
                         |      |            ^
                         |      |            |
                         |      |            (15) ...to here
                         |      |            (16) following ‘true’ branch...
                         |  706 |                 return rte_mov15_or_less(dst, src, n);
                         |      |                        ~
                         |      |                        |
                         |      |                        (17) inlined call to ‘rte_mov15_or_less’ from ‘rte_memcpy_aligned’
                         |
                         +--> ‘rte_mov15_or_less’: events 18-21
                                |
                                |   81 |         if (n & 8) {
                                |      |            ^
                                |      |            |
                                |      |            (18) ...to here
                                |      |            (19) following ‘true’ branch...
                                |   82 |                 ((struct rte_uint64_alias *)dst)->val =
                                |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                                                       |
                                |      |                                                       (21) out-of-bounds write from byte 1 till byte 7 but ‘reps’ ends at byte 1
                                |   83 |                         ((const struct rte_uint64_alias *)src)->val;
                                |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                                                               |
                                |      |                                                               (20) ...to here
                                |
../lib/eal/x86/include/rte_memcpy.h:82:55: note: write of 7 bytes to beyond the end of ‘reps’
   82 |                 ((struct rte_uint64_alias *)dst)->val =
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
   83 |                         ((const struct rte_uint64_alias *)src)->val;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  ┌──────────────────────────────────────────────────────────────────────┐
  │                    write of ‘uint64_t’ (8 bytes)                     │
  └──────────────────────────────────────────────────────────────────────┘
              │                                   │
              │                                   │
              v                                   v
  ┌────────────────────────┐┌────────────────────────────────────────────┐
  │‘reps’ (type: ‘uint8_t’)││             after valid range              │
  └────────────────────────┘└────────────────────────────────────────────┘
  ├───────────┬────────────┤├─────────────────────┬──────────────────────┤
              │                                   │
     ╭────────┴───────╮               ╭───────────┴──────────╮
     │capacity: 1 byte│               │⚠️  overflow of 7 bytes│
     ╰────────────────╯               ╰──────────────────────╯

In function ‘rte_mov15_or_less’,
    inlined from ‘rte_memcpy_generic’ at ../lib/eal/x86/include/rte_memcpy.h:395:10,
    inlined from ‘rte_memcpy’ at ../lib/eal/x86/include/rte_memcpy.h:757:10,
    inlined from ‘zxdh_get_res_info’ at ../drivers/net/zxdh/zxdh_common.c:231:2:
../lib/eal/x86/include/rte_memcpy.h:82:55: warning: stack-based buffer overflow [CWE-121] [-Wanalyzer-out-of-bounds]
   82 |                 ((struct rte_uint64_alias *)dst)->val =
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
   83 |                         ((const struct rte_uint64_alias *)src)->val;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘zxdh_hashidx_get’: events 1-3
    |
    |../drivers/net/zxdh/zxdh_common.c:273:1:
    |  262 |         uint8_t reps = 0;
    |      |                 ~~~~
    |      |                 |
    |      |                 (2) capacity: 1 byte
    |......
    |  273 | zxdh_hashidx_get(struct rte_eth_dev *dev, uint8_t *hash_idx)
    |      | ^~~~~~~~~~~~~~~~
    |      | |
    |      | (1) entry to ‘zxdh_hashidx_get’
    |......
    |  278 |         int32_t ret = zxdh_get_res_hash_id(&param, hash_idx);
    |      |                       ~
    |      |                       |
    |      |                       (3) inlined call to ‘zxdh_get_res_hash_id’ from ‘zxdh_hashidx_get’
    |
    +--> ‘zxdh_get_res_hash_id’: event 4
           |
           |  265 |         if (zxdh_get_res_info(in, ZXDH_TBL_FIELD_HASHID, &reps, &reps_len) != ZXDH_BAR_MSG_OK)
           |      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |             |
           |      |             (4) calling ‘zxdh_get_res_info’ from ‘zxdh_hashidx_get’
           |
         ‘zxdh_get_res_info’: events 5-12
           |
           |  186 | zxdh_get_res_info(struct zxdh_res_para *dev, uint8_t field, uint8_t *res, uint16_t *len)
           |      | ^~~~~~~~~~~~~~~~~
           |      | |
           |      | (5) entry to ‘zxdh_get_res_info’
           |......
           |  192 |         if (!res || !dev)
           |      |            ~
           |      |            |
           |      |            (6) following ‘false’ branch...
           |......
           |  195 |         struct zxdh_tbl_msg_header tbl_msg = {
           |      |                                    ~~~~~~~
           |      |                                    |
           |      |                                    (7) ...to here
           |......
           |  217 |         if (ret != ZXDH_BAR_MSG_OK) {
           |      |            ~
           |      |            |
           |      |            (8) following ‘false’ branch (when ‘ret == 0’)...
           |......
           |  225 |         if (tbl_reps->check != ZXDH_TBL_MSG_PRO_SUCCESS) {
           |      |            ~~~~~~~~~~~~~~~~
           |      |            |        |
           |      |            |        (9) ...to here
           |      |            (10) following ‘false’ branch...
           |......
           |  230 |         *len = tbl_reps->len;
           |      |                ~~~~~~~~~~~~~
           |      |                        |
           |      |                        (11) ...to here
           |  231 |         rte_memcpy(res, (recv_buf + ZXDH_REPS_HEADER_OFFSET +
           |      |         ~
           |      |         |
           |      |         (12) inlined call to ‘rte_memcpy’ from ‘zxdh_get_res_info’
           |
           +--> ‘rte_memcpy’: events 13-14
                  |
                  |../lib/eal/x86/include/rte_memcpy.h:754:12:
                  |  754 |         if (!(((uintptr_t)dst | (uintptr_t)src) & ALIGNMENT_MASK))
                  |      |            ^
                  |      |            |
                  |      |            (13) following ‘false’ branch...
                  |......
                  |  757 |                 return rte_memcpy_generic(dst, src, n);
                  |      |                        ~
                  |      |                        |
                  |      |                        (14) inlined call to ‘rte_memcpy_generic’ from ‘rte_memcpy’
                  |
                  +--> ‘rte_memcpy_generic’: events 15-17
                         |
                         |  394 |         if (n < 16) {
                         |      |            ^
                         |      |            |
                         |      |            (15) ...to here
                         |      |            (16) following ‘true’ branch...
                         |  395 |                 return rte_mov15_or_less(dst, src, n);
                         |      |                        ~
                         |      |                        |
                         |      |                        (17) inlined call to ‘rte_mov15_or_less’ from ‘rte_memcpy_generic’
                         |
                         +--> ‘rte_mov15_or_less’: events 18-21
                                |
                                |   81 |         if (n & 8) {
                                |      |            ^
                                |      |            |
                                |      |            (18) ...to here
                                |      |            (19) following ‘true’ branch...
                                |   82 |                 ((struct rte_uint64_alias *)dst)->val =
                                |      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                                                       |
                                |      |                                                       (21) out-of-bounds write from byte 1 till byte 7 but ‘reps’ ends at byte 1
                                |   83 |                         ((const struct rte_uint64_alias *)src)->val;
                                |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                                |      |                                                               |
                                |      |                                                               (20) ...to here
                                |
../lib/eal/x86/include/rte_memcpy.h:82:55: note: write of 7 bytes to beyond the end of ‘reps’
   82 |                 ((struct rte_uint64_alias *)dst)->val =
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
   83 |                         ((const struct rte_uint64_alias *)src)->val;
      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

  ┌──────────────────────────────────────────────────────────────────────┐
  │                    write of ‘uint64_t’ (8 bytes)                     │
  └──────────────────────────────────────────────────────────────────────┘
              │                                   │
              │                                   │
              v                                   v
  ┌────────────────────────┐┌────────────────────────────────────────────┐
  │‘reps’ (type: ‘uint8_t’)││             after valid range              │
  └────────────────────────┘└────────────────────────────────────────────┘
  ├───────────┬────────────┤├─────────────────────┬──────────────────────┤
              │                                   │
     ╭────────┴───────╮               ╭───────────┴──────────╮
     │capacity: 1 byte│               │⚠️  overflow of 7 bytes│
     ╰────────────────╯               ╰──────────────────────╯



More information about the dev mailing list