All of lore.kernel.org
 help / color / mirror / Atom feed
From: kernel test robot <lkp@intel.com>
To: kbuild@lists.01.org
Subject: drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:637 npc_update_entry() error: buffer overflow 'field->kw_mask' 7 <= 7
Date: Fri, 23 Jul 2021 14:58:29 +0800	[thread overview]
Message-ID: <202107231421.1myc4Lw4-lkp@intel.com> (raw)

[-- Attachment #1: Type: text/plain, Size: 10226 bytes --]

CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Subbaraya Sundeep <sbhatta@marvell.com>
CC: Jakub Kicinski <kuba@kernel.org>
CC: Sunil Goutham <sgoutham@marvell.com>
CC: Naveen Mamindlapalli <naveenm@marvell.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   8baef6386baaefb776bdd09b5c7630cf057c51c6
commit: 55307fcb925846d760ed80f4a8359dd4331c52bd octeontx2-af: Add mbox messages to install and delete MCAM rules
date:   8 months ago
:::::: branch date: 3 hours ago
:::::: commit date: 8 months ago
config: mips-randconfig-m031-20210723 (attached as .config)
compiler: mips64-linux-gcc (GCC) 10.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

New smatch warnings:
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:637 npc_update_entry() error: buffer overflow 'field->kw_mask' 7 <= 7
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:638 npc_update_entry() error: buffer overflow 'dummy.kw' 7 <= 7
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:643 npc_update_entry() error: buffer overflow 'dummy.kw_mask' 7 <= 7

Old smatch warnings:
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:642 npc_update_entry() error: buffer overflow 'field->kw_mask' 7 <= 7
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:651 npc_update_entry() error: buffer overflow 'field->kw_mask' 7 <= 7
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:653 npc_update_entry() error: buffer overflow 'field->kw_mask' 7 <= 8
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:654 npc_update_entry() error: buffer overflow 'dummy.kw' 7 <= 7
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:655 npc_update_entry() error: buffer overflow 'dummy.kw' 7 <= 8
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:659 npc_update_entry() error: buffer overflow 'field->kw_mask' 7 <= 7
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:661 npc_update_entry() error: buffer overflow 'field->kw_mask' 7 <= 8
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:662 npc_update_entry() error: buffer overflow 'dummy.kw_mask' 7 <= 7
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:663 npc_update_entry() error: buffer overflow 'dummy.kw_mask' 7 <= 8
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c:1206 rvu_mbox_handler_npc_delete_flow() error: dereferencing freed memory 'iter'

vim +637 drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_fs.c

55307fcb925846 Subbaraya Sundeep 2020-11-15  588  
55307fcb925846 Subbaraya Sundeep 2020-11-15  589  /* npc_update_entry - Based on the masks generated during
55307fcb925846 Subbaraya Sundeep 2020-11-15  590   * the key scanning, updates the given entry with value and
55307fcb925846 Subbaraya Sundeep 2020-11-15  591   * masks for the field of interest. Maximum 16 bytes of a packet
55307fcb925846 Subbaraya Sundeep 2020-11-15  592   * header can be extracted by HW hence lo and hi are sufficient.
55307fcb925846 Subbaraya Sundeep 2020-11-15  593   * When field bytes are less than or equal to 8 then hi should be
55307fcb925846 Subbaraya Sundeep 2020-11-15  594   * 0 for value and mask.
55307fcb925846 Subbaraya Sundeep 2020-11-15  595   *
55307fcb925846 Subbaraya Sundeep 2020-11-15  596   * If exact match of value is required then mask should be all 1's.
55307fcb925846 Subbaraya Sundeep 2020-11-15  597   * If any bits in mask are 0 then corresponding bits in value are
55307fcb925846 Subbaraya Sundeep 2020-11-15  598   * dont care.
55307fcb925846 Subbaraya Sundeep 2020-11-15  599   */
55307fcb925846 Subbaraya Sundeep 2020-11-15  600  static void npc_update_entry(struct rvu *rvu, enum key_fields type,
55307fcb925846 Subbaraya Sundeep 2020-11-15  601  			     struct mcam_entry *entry, u64 val_lo,
55307fcb925846 Subbaraya Sundeep 2020-11-15  602  			     u64 val_hi, u64 mask_lo, u64 mask_hi, u8 intf)
55307fcb925846 Subbaraya Sundeep 2020-11-15  603  {
55307fcb925846 Subbaraya Sundeep 2020-11-15  604  	struct npc_mcam *mcam = &rvu->hw->mcam;
55307fcb925846 Subbaraya Sundeep 2020-11-15  605  	struct mcam_entry dummy = { {0} };
55307fcb925846 Subbaraya Sundeep 2020-11-15  606  	struct npc_key_field *field;
55307fcb925846 Subbaraya Sundeep 2020-11-15  607  	u64 kw1, kw2, kw3;
55307fcb925846 Subbaraya Sundeep 2020-11-15  608  	u8 shift;
55307fcb925846 Subbaraya Sundeep 2020-11-15  609  	int i;
55307fcb925846 Subbaraya Sundeep 2020-11-15  610  
55307fcb925846 Subbaraya Sundeep 2020-11-15  611  	field = &mcam->rx_key_fields[type];
55307fcb925846 Subbaraya Sundeep 2020-11-15  612  	if (is_npc_intf_tx(intf))
55307fcb925846 Subbaraya Sundeep 2020-11-15  613  		field = &mcam->tx_key_fields[type];
55307fcb925846 Subbaraya Sundeep 2020-11-15  614  
55307fcb925846 Subbaraya Sundeep 2020-11-15  615  	if (!field->nr_kws)
55307fcb925846 Subbaraya Sundeep 2020-11-15  616  		return;
55307fcb925846 Subbaraya Sundeep 2020-11-15  617  
55307fcb925846 Subbaraya Sundeep 2020-11-15  618  	for (i = 0; i < NPC_MAX_KWS_IN_KEY; i++) {
55307fcb925846 Subbaraya Sundeep 2020-11-15  619  		if (!field->kw_mask[i])
55307fcb925846 Subbaraya Sundeep 2020-11-15  620  			continue;
55307fcb925846 Subbaraya Sundeep 2020-11-15  621  		/* place key value in kw[x] */
55307fcb925846 Subbaraya Sundeep 2020-11-15  622  		shift = __ffs64(field->kw_mask[i]);
55307fcb925846 Subbaraya Sundeep 2020-11-15  623  		/* update entry value */
55307fcb925846 Subbaraya Sundeep 2020-11-15  624  		kw1 = (val_lo << shift) & field->kw_mask[i];
55307fcb925846 Subbaraya Sundeep 2020-11-15  625  		dummy.kw[i] = kw1;
55307fcb925846 Subbaraya Sundeep 2020-11-15  626  		/* update entry mask */
55307fcb925846 Subbaraya Sundeep 2020-11-15  627  		kw1 = (mask_lo << shift) & field->kw_mask[i];
55307fcb925846 Subbaraya Sundeep 2020-11-15  628  		dummy.kw_mask[i] = kw1;
55307fcb925846 Subbaraya Sundeep 2020-11-15  629  
55307fcb925846 Subbaraya Sundeep 2020-11-15  630  		if (field->nr_kws == 1)
55307fcb925846 Subbaraya Sundeep 2020-11-15  631  			break;
55307fcb925846 Subbaraya Sundeep 2020-11-15  632  		/* place remaining bits of key value in kw[x + 1] */
55307fcb925846 Subbaraya Sundeep 2020-11-15  633  		if (field->nr_kws == 2) {
55307fcb925846 Subbaraya Sundeep 2020-11-15  634  			/* update entry value */
55307fcb925846 Subbaraya Sundeep 2020-11-15  635  			kw2 = shift ? val_lo >> (64 - shift) : 0;
55307fcb925846 Subbaraya Sundeep 2020-11-15  636  			kw2 |= (val_hi << shift);
55307fcb925846 Subbaraya Sundeep 2020-11-15 @637  			kw2 &= field->kw_mask[i + 1];
55307fcb925846 Subbaraya Sundeep 2020-11-15 @638  			dummy.kw[i + 1] = kw2;
55307fcb925846 Subbaraya Sundeep 2020-11-15  639  			/* update entry mask */
55307fcb925846 Subbaraya Sundeep 2020-11-15  640  			kw2 = shift ? mask_lo >> (64 - shift) : 0;
55307fcb925846 Subbaraya Sundeep 2020-11-15  641  			kw2 |= (mask_hi << shift);
55307fcb925846 Subbaraya Sundeep 2020-11-15  642  			kw2 &= field->kw_mask[i + 1];
55307fcb925846 Subbaraya Sundeep 2020-11-15 @643  			dummy.kw_mask[i + 1] = kw2;
55307fcb925846 Subbaraya Sundeep 2020-11-15  644  			break;
55307fcb925846 Subbaraya Sundeep 2020-11-15  645  		}
55307fcb925846 Subbaraya Sundeep 2020-11-15  646  		/* place remaining bits of key value in kw[x + 1], kw[x + 2] */
55307fcb925846 Subbaraya Sundeep 2020-11-15  647  		if (field->nr_kws == 3) {
55307fcb925846 Subbaraya Sundeep 2020-11-15  648  			/* update entry value */
55307fcb925846 Subbaraya Sundeep 2020-11-15  649  			kw2 = shift ? val_lo >> (64 - shift) : 0;
55307fcb925846 Subbaraya Sundeep 2020-11-15  650  			kw2 |= (val_hi << shift);
55307fcb925846 Subbaraya Sundeep 2020-11-15  651  			kw2 &= field->kw_mask[i + 1];
55307fcb925846 Subbaraya Sundeep 2020-11-15  652  			kw3 = shift ? val_hi >> (64 - shift) : 0;
55307fcb925846 Subbaraya Sundeep 2020-11-15  653  			kw3 &= field->kw_mask[i + 2];
55307fcb925846 Subbaraya Sundeep 2020-11-15  654  			dummy.kw[i + 1] = kw2;
55307fcb925846 Subbaraya Sundeep 2020-11-15  655  			dummy.kw[i + 2] = kw3;
55307fcb925846 Subbaraya Sundeep 2020-11-15  656  			/* update entry mask */
55307fcb925846 Subbaraya Sundeep 2020-11-15  657  			kw2 = shift ? mask_lo >> (64 - shift) : 0;
55307fcb925846 Subbaraya Sundeep 2020-11-15  658  			kw2 |= (mask_hi << shift);
55307fcb925846 Subbaraya Sundeep 2020-11-15  659  			kw2 &= field->kw_mask[i + 1];
55307fcb925846 Subbaraya Sundeep 2020-11-15  660  			kw3 = shift ? mask_hi >> (64 - shift) : 0;
55307fcb925846 Subbaraya Sundeep 2020-11-15  661  			kw3 &= field->kw_mask[i + 2];
55307fcb925846 Subbaraya Sundeep 2020-11-15  662  			dummy.kw_mask[i + 1] = kw2;
55307fcb925846 Subbaraya Sundeep 2020-11-15  663  			dummy.kw_mask[i + 2] = kw3;
55307fcb925846 Subbaraya Sundeep 2020-11-15  664  			break;
55307fcb925846 Subbaraya Sundeep 2020-11-15  665  		}
55307fcb925846 Subbaraya Sundeep 2020-11-15  666  	}
55307fcb925846 Subbaraya Sundeep 2020-11-15  667  	/* dummy is ready with values and masks for given key
55307fcb925846 Subbaraya Sundeep 2020-11-15  668  	 * field now clear and update input entry with those
55307fcb925846 Subbaraya Sundeep 2020-11-15  669  	 */
55307fcb925846 Subbaraya Sundeep 2020-11-15  670  	for (i = 0; i < NPC_MAX_KWS_IN_KEY; i++) {
55307fcb925846 Subbaraya Sundeep 2020-11-15  671  		if (!field->kw_mask[i])
55307fcb925846 Subbaraya Sundeep 2020-11-15  672  			continue;
55307fcb925846 Subbaraya Sundeep 2020-11-15  673  		entry->kw[i] &= ~field->kw_mask[i];
55307fcb925846 Subbaraya Sundeep 2020-11-15  674  		entry->kw_mask[i] &= ~field->kw_mask[i];
55307fcb925846 Subbaraya Sundeep 2020-11-15  675  
55307fcb925846 Subbaraya Sundeep 2020-11-15  676  		entry->kw[i] |= dummy.kw[i];
55307fcb925846 Subbaraya Sundeep 2020-11-15  677  		entry->kw_mask[i] |= dummy.kw_mask[i];
55307fcb925846 Subbaraya Sundeep 2020-11-15  678  	}
55307fcb925846 Subbaraya Sundeep 2020-11-15  679  }
55307fcb925846 Subbaraya Sundeep 2020-11-15  680  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 34748 bytes --]

                 reply	other threads:[~2021-07-23  6:58 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202107231421.1myc4Lw4-lkp@intel.com \
    --to=lkp@intel.com \
    --cc=kbuild@lists.01.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.