[4/8] net/dpaa: fix the oob access

Message ID 1522918464-4586-4-git-send-email-hemant.agrawal@nxp.com
State New
Headers show
Series
  • [1/8] bus/dpaa: fix the resource leak issue
Related show

Commit Message

Hemant April 5, 2018, 8:54 a.m.
Fixes: b21ed3e2a16d ("net/dpaa: support extended statistics")
Coverity issue: 268318
Cc: stable@dpdk.org

Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>

---
 drivers/net/dpaa/dpaa_ethdev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

-- 
2.7.4

Comments

Shreyansh Jain April 9, 2018, 7:23 a.m. | #1
On Thursday 05 April 2018 02:24 PM, Hemant Agrawal wrote:
> Fixes: b21ed3e2a16d ("net/dpaa: support extended statistics")

> Coverity issue: 268318

> Cc: stable@dpdk.org

> 

> Signed-off-by: Hemant Agrawal <hemant.agrawal@nxp.com>

> ---

>   drivers/net/dpaa/dpaa_ethdev.c | 5 ++++-

>   1 file changed, 4 insertions(+), 1 deletion(-)

> 

> diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c

> index 0aad111..cbdc4f2 100644

> --- a/drivers/net/dpaa/dpaa_ethdev.c

> +++ b/drivers/net/dpaa/dpaa_ethdev.c

> @@ -339,6 +339,9 @@ dpaa_xstats_get_names(__rte_unused struct rte_eth_dev *dev,


Definition of this function is:

static int
dpaa_xstats_get_names(__rte_unused struct rte_eth_dev *dev,
                       struct rte_eth_xstat_name *xstats_names,
                       __rte_unused unsigned int limit)

>   {

>   	unsigned int i, stat_cnt = RTE_DIM(dpaa_xstats_strings);

>   

> +	if (limit < stat_cnt)

> +		return stat_cnt;


As this patch is using the 'limit' argument, '__rte_unused' should be 
removed from the function arguments.

> +

>   	if (xstats_names != NULL)

>   		for (i = 0; i < stat_cnt; i++)

>   			snprintf(xstats_names[i].name,

> @@ -366,7 +369,7 @@ dpaa_xstats_get_by_id(struct rte_eth_dev *dev, const uint64_t *ids,

>   			return 0;

>   

>   		fman_if_stats_get_all(dpaa_intf->fif, values_copy,

> -				      sizeof(struct dpaa_if_stats));

> +				      sizeof(struct dpaa_if_stats) / 8);

>   

>   		for (i = 0; i < stat_cnt; i++)

>   			values[i] =

> 


Once the above is correct, please use:

Acked-By: Shreyansh Jain <shreyansh.jain@nxp.com>

Patch

diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index 0aad111..cbdc4f2 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -339,6 +339,9 @@  dpaa_xstats_get_names(__rte_unused struct rte_eth_dev *dev,
 {
 	unsigned int i, stat_cnt = RTE_DIM(dpaa_xstats_strings);
 
+	if (limit < stat_cnt)
+		return stat_cnt;
+
 	if (xstats_names != NULL)
 		for (i = 0; i < stat_cnt; i++)
 			snprintf(xstats_names[i].name,
@@ -366,7 +369,7 @@  dpaa_xstats_get_by_id(struct rte_eth_dev *dev, const uint64_t *ids,
 			return 0;
 
 		fman_if_stats_get_all(dpaa_intf->fif, values_copy,
-				      sizeof(struct dpaa_if_stats));
+				      sizeof(struct dpaa_if_stats) / 8);
 
 		for (i = 0; i < stat_cnt; i++)
 			values[i] =