All of lore.kernel.org
 help / color / mirror / Atom feed
From: Harman Kalra <hkalra@marvell.com>
To: <dev@dpdk.org>, Ferruh Yigit <ferruh.yigit@intel.com>,
	Anatoly Burakov <anatoly.burakov@intel.com>,
	Stephen Hemminger <sthemmin@microsoft.com>,
	"Long Li" <longli@microsoft.com>,
	Hemant Agrawal <hemant.agrawal@nxp.com>,
	"Sachin Saxena" <sachin.saxena@oss.nxp.com>,
	Jakub Grajciar <jgrajcia@cisco.com>,
	Matan Azrad <matan@nvidia.com>,
	Viacheslav Ovsiienko <viacheslavo@nvidia.com>
Cc: <david.marchand@redhat.com>, <john.mcnamara@intel.com>,
	Harman Kalra <hkalra@marvell.com>
Subject: [dpdk-dev] [PATCH 4/6] drivers: fix argument cannot be negative
Date: Mon, 1 Nov 2021 23:23:35 +0530	[thread overview]
Message-ID: <20211101175337.83358-4-hkalra@marvell.com> (raw)
In-Reply-To: <20211101175337.83358-1-hkalra@marvell.com>

This patch fixes coverity issue by adding a check for
negative event fd value.

Coverity issue: 373723,373720,373719,373718,373715,373714,373713,373710,
		373707,373706,373705,373704,373701,373700,373698,373695,
		373692,373690,373689
Fixes: d61138d4f0e2 ("drivers: remove direct access to interrupt handle")

Signed-off-by: Harman Kalra <hkalra@marvell.com>
---
 drivers/bus/pci/linux/pci_uio.c      |  6 ++++++
 drivers/bus/pci/linux/pci_vfio.c     | 15 +++++++++++++++
 drivers/bus/pci/pci_common_uio.c     |  3 ++-
 drivers/bus/vmbus/linux/vmbus_uio.c  |  6 +++++-
 drivers/bus/vmbus/vmbus_common_uio.c |  4 +++-
 drivers/net/dpaa/dpaa_ethdev.c       |  3 +++
 drivers/net/memif/memif_socket.c     |  6 +++++-
 drivers/net/memif/rte_eth_memif.c    | 12 +++++++++---
 drivers/vdpa/mlx5/mlx5_vdpa_virtq.c  |  3 +++
 9 files changed, 51 insertions(+), 7 deletions(-)

diff --git a/drivers/bus/pci/linux/pci_uio.c b/drivers/bus/pci/linux/pci_uio.c
index 2ee5d04672..d52125e49b 100644
--- a/drivers/bus/pci/linux/pci_uio.c
+++ b/drivers/bus/pci/linux/pci_uio.c
@@ -37,6 +37,9 @@ pci_uio_read_config(const struct rte_intr_handle *intr_handle,
 {
 	int uio_cfg_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (uio_cfg_fd < 0)
+		return -1;
+
 	return pread(uio_cfg_fd, buf, len, offset);
 }
 
@@ -46,6 +49,9 @@ pci_uio_write_config(const struct rte_intr_handle *intr_handle,
 {
 	int uio_cfg_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (uio_cfg_fd < 0)
+		return -1;
+
 	return pwrite(uio_cfg_fd, buf, len, offset);
 }
 
diff --git a/drivers/bus/pci/linux/pci_vfio.c b/drivers/bus/pci/linux/pci_vfio.c
index edcee92556..779525aa3e 100644
--- a/drivers/bus/pci/linux/pci_vfio.c
+++ b/drivers/bus/pci/linux/pci_vfio.c
@@ -49,6 +49,9 @@ pci_vfio_read_config(const struct rte_intr_handle *intr_handle,
 {
 	int vfio_dev_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (vfio_dev_fd < 0)
+		return -1;
+
 	return pread64(vfio_dev_fd, buf, len,
 	       VFIO_GET_REGION_ADDR(VFIO_PCI_CONFIG_REGION_INDEX) + offs);
 }
@@ -59,6 +62,9 @@ pci_vfio_write_config(const struct rte_intr_handle *intr_handle,
 {
 	int vfio_dev_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (vfio_dev_fd < 0)
+		return -1;
+
 	return pwrite64(vfio_dev_fd, buf, len,
 	       VFIO_GET_REGION_ADDR(VFIO_PCI_CONFIG_REGION_INDEX) + offs);
 }
@@ -1012,6 +1018,9 @@ pci_vfio_unmap_resource_primary(struct rte_pci_device *dev)
 	}
 
 #endif
+	if (rte_intr_fd_get(dev->intr_handle) < 0)
+		return -1;
+
 	if (close(rte_intr_fd_get(dev->intr_handle)) < 0) {
 		RTE_LOG(INFO, EAL, "Error when closing eventfd file descriptor for %s\n",
 			pci_addr);
@@ -1114,6 +1123,9 @@ pci_vfio_ioport_read(struct rte_pci_ioport *p,
 	const struct rte_intr_handle *intr_handle = p->dev->intr_handle;
 	int vfio_dev_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (vfio_dev_fd < 0)
+		return;
+
 	if (pread64(vfio_dev_fd, data,
 		    len, p->base + offset) <= 0)
 		RTE_LOG(ERR, EAL,
@@ -1128,6 +1140,9 @@ pci_vfio_ioport_write(struct rte_pci_ioport *p,
 	const struct rte_intr_handle *intr_handle = p->dev->intr_handle;
 	int vfio_dev_fd = rte_intr_dev_fd_get(intr_handle);
 
+	if (vfio_dev_fd < 0)
+		return;
+
 	if (pwrite64(vfio_dev_fd, data,
 		     len, p->base + offset) <= 0)
 		RTE_LOG(ERR, EAL,
diff --git a/drivers/bus/pci/pci_common_uio.c b/drivers/bus/pci/pci_common_uio.c
index 244c9a8940..76c661f054 100644
--- a/drivers/bus/pci/pci_common_uio.c
+++ b/drivers/bus/pci/pci_common_uio.c
@@ -233,7 +233,8 @@ pci_uio_unmap_resource(struct rte_pci_device *dev)
 	rte_free(uio_res);
 
 	/* close fd if in primary process */
-	close(rte_intr_fd_get(dev->intr_handle));
+	if (rte_intr_fd_get(dev->intr_handle) >= 0)
+		close(rte_intr_fd_get(dev->intr_handle));
 	uio_cfg_fd = rte_intr_dev_fd_get(dev->intr_handle);
 	if (uio_cfg_fd >= 0) {
 		close(uio_cfg_fd);
diff --git a/drivers/bus/vmbus/linux/vmbus_uio.c b/drivers/bus/vmbus/linux/vmbus_uio.c
index 9c5c1aeca3..5db70f8e0d 100644
--- a/drivers/bus/vmbus/linux/vmbus_uio.c
+++ b/drivers/bus/vmbus/linux/vmbus_uio.c
@@ -30,7 +30,8 @@ static void *vmbus_map_addr;
 /* Control interrupts */
 void vmbus_uio_irq_control(struct rte_vmbus_device *dev, int32_t onoff)
 {
-	if (write(rte_intr_fd_get(dev->intr_handle), &onoff,
+	if ((rte_intr_fd_get(dev->intr_handle) < 0) ||
+	    write(rte_intr_fd_get(dev->intr_handle), &onoff,
 		  sizeof(onoff)) < 0) {
 		VMBUS_LOG(ERR, "cannot write to %d:%s",
 			  rte_intr_fd_get(dev->intr_handle),
@@ -43,6 +44,9 @@ int vmbus_uio_irq_read(struct rte_vmbus_device *dev)
 	int32_t count;
 	int cc;
 
+	if (rte_intr_fd_get(dev->intr_handle) < 0)
+		return -1;
+
 	cc = read(rte_intr_fd_get(dev->intr_handle), &count,
 		  sizeof(count));
 	if (cc < (int)sizeof(count)) {
diff --git a/drivers/bus/vmbus/vmbus_common_uio.c b/drivers/bus/vmbus/vmbus_common_uio.c
index 336296d6a8..882a24f869 100644
--- a/drivers/bus/vmbus/vmbus_common_uio.c
+++ b/drivers/bus/vmbus/vmbus_common_uio.c
@@ -258,7 +258,9 @@ vmbus_uio_unmap_resource(struct rte_vmbus_device *dev)
 	rte_free(uio_res);
 
 	/* close fd if in primary process */
-	close(rte_intr_fd_get(dev->intr_handle));
+	if (rte_intr_fd_get(dev->intr_handle) >= 0)
+		close(rte_intr_fd_get(dev->intr_handle));
+
 	if (rte_intr_dev_fd_get(dev->intr_handle) >= 0) {
 		close(rte_intr_dev_fd_get(dev->intr_handle));
 		rte_intr_dev_fd_set(dev->intr_handle, -1);
diff --git a/drivers/net/dpaa/dpaa_ethdev.c b/drivers/net/dpaa/dpaa_ethdev.c
index b9bf9d2966..e49f765434 100644
--- a/drivers/net/dpaa/dpaa_ethdev.c
+++ b/drivers/net/dpaa/dpaa_ethdev.c
@@ -371,6 +371,9 @@ static void dpaa_interrupt_handler(void *param)
 	dpaa_dev = container_of(rdev, struct rte_dpaa_device, device);
 	intr_handle = dpaa_dev->intr_handle;
 
+	if (rte_intr_fd_get(intr_handle) < 0)
+		return;
+
 	bytes_read = read(rte_intr_fd_get(intr_handle), &buf,
 			  sizeof(uint64_t));
 	if (bytes_read < 0)
diff --git a/drivers/net/memif/memif_socket.c b/drivers/net/memif/memif_socket.c
index d48c3685d9..c845c20ccf 100644
--- a/drivers/net/memif/memif_socket.c
+++ b/drivers/net/memif/memif_socket.c
@@ -508,7 +508,8 @@ memif_intr_unregister_handler(struct rte_intr_handle *intr_handle, void *arg)
 	struct memif_control_channel *cc = arg;
 
 	/* close control channel fd */
-	close(rte_intr_fd_get(intr_handle));
+	if (rte_intr_fd_get(intr_handle) >= 0)
+		close(rte_intr_fd_get(intr_handle));
 	/* clear message queue */
 	while ((elt = TAILQ_FIRST(&cc->msg_queue)) != NULL) {
 		TAILQ_REMOVE(&cc->msg_queue, elt, next);
@@ -651,6 +652,9 @@ memif_msg_receive(struct memif_control_channel *cc)
 	mh.msg_control = ctl;
 	mh.msg_controllen = sizeof(ctl);
 
+	if (rte_intr_fd_get(cc->intr_handle) < 0)
+		return -1;
+
 	size = recvmsg(rte_intr_fd_get(cc->intr_handle), &mh, 0);
 	if (size != sizeof(memif_msg_t)) {
 		MIF_LOG(DEBUG, "Invalid message size = %zd", size);
diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index 8cec493ffd..2935ae6ebe 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -325,7 +325,8 @@ eth_memif_rx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 	}
 
 	/* consume interrupt */
-	if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0)
+	if (((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) &&
+	    (rte_intr_fd_get(mq->intr_handle) >= 0))
 		size = read(rte_intr_fd_get(mq->intr_handle), &b,
 			    sizeof(b));
 
@@ -460,7 +461,8 @@ eth_memif_rx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 	}
 
 	/* consume interrupt */
-	if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) {
+	if ((rte_intr_fd_get(mq->intr_handle) >= 0) &&
+	    ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0)) {
 		uint64_t b;
 		ssize_t size __rte_unused;
 		size = read(rte_intr_fd_get(mq->intr_handle), &b,
@@ -680,7 +682,8 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 	else
 		__atomic_store_n(&ring->tail, slot, __ATOMIC_RELEASE);
 
-	if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) {
+	if (((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) &&
+	    (rte_intr_fd_get(mq->intr_handle) >= 0)) {
 		a = 1;
 		size = write(rte_intr_fd_get(mq->intr_handle), &a,
 			     sizeof(a));
@@ -835,6 +838,9 @@ eth_memif_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 	/* Send interrupt, if enabled. */
 	if ((ring->flags & MEMIF_RING_FLAG_MASK_INT) == 0) {
 		uint64_t a = 1;
+		if (rte_intr_fd_get(mq->intr_handle) < 0)
+			return -1;
+
 		ssize_t size = write(rte_intr_fd_get(mq->intr_handle),
 				     &a, sizeof(a));
 		if (unlikely(size < 0)) {
diff --git a/drivers/vdpa/mlx5/mlx5_vdpa_virtq.c b/drivers/vdpa/mlx5/mlx5_vdpa_virtq.c
index cb37ba097c..db971bad48 100644
--- a/drivers/vdpa/mlx5/mlx5_vdpa_virtq.c
+++ b/drivers/vdpa/mlx5/mlx5_vdpa_virtq.c
@@ -24,6 +24,9 @@ mlx5_vdpa_virtq_handler(void *cb_arg)
 	uint64_t buf;
 	int nbytes;
 
+	if (rte_intr_fd_get(virtq->intr_handle) < 0)
+		return;
+
 	do {
 		nbytes = read(rte_intr_fd_get(virtq->intr_handle), &buf,
 			      8);
-- 
2.18.0


  parent reply	other threads:[~2021-11-01 17:54 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-01 17:53 [dpdk-dev] [PATCH 1/6] interrupts: fix argument cannot be negative Harman Kalra
2021-11-01 17:53 ` [dpdk-dev] [PATCH 2/6] lib: " Harman Kalra
2021-11-01 17:53 ` [dpdk-dev] [PATCH 3/6] drivers: fix bad bit shift operation Harman Kalra
2021-11-02  1:22   ` Wang, Haiyue
2021-11-01 17:53 ` Harman Kalra [this message]
2021-11-01 17:53 ` [dpdk-dev] [PATCH 5/6] drivers: fix improper use of negative value Harman Kalra
2021-11-01 17:53 ` [dpdk-dev] [PATCH 6/6] net/mlx4: fix dereference after null check Harman Kalra
2021-11-02  7:34   ` Slava Ovsiienko
2021-11-08 16:32     ` David Marchand

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211101175337.83358-4-hkalra@marvell.com \
    --to=hkalra@marvell.com \
    --cc=anatoly.burakov@intel.com \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    --cc=ferruh.yigit@intel.com \
    --cc=hemant.agrawal@nxp.com \
    --cc=jgrajcia@cisco.com \
    --cc=john.mcnamara@intel.com \
    --cc=longli@microsoft.com \
    --cc=matan@nvidia.com \
    --cc=sachin.saxena@oss.nxp.com \
    --cc=sthemmin@microsoft.com \
    --cc=viacheslavo@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.