DPDK-dev Archive on lore.kernel.org
 help / color / Atom feed
* [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference
@ 2019-05-23  4:31 Andy Pei
  2019-05-23  5:20 ` Xu, Rosen
  0 siblings, 1 reply; 3+ messages in thread
From: Andy Pei @ 2019-05-23  4:31 UTC (permalink / raw)
  To: dev; +Cc: andy.pei, rosen.xu, stable

In current code, scenario may happens that
when function ipn3ke_hw_tm_node_wr is called,
struct ipn3ke_tm_node n has a NULL element
parent_node, however, the element parent_node
of struct ipn3ke_tm_node n is used in an invalid way.
After applying this patch,
this null pointer dereference is avoided.

Coverity issue: 337921
Fixes: c820468ac99c ("net/ipn3ke: support TM")
Cc: rosen.xu@intel.com
Cc: stable@dpdk.org

Signed-off-by: Andy Pei <andy.pei@intel.com>
---
 drivers/net/ipn3ke/ipn3ke_tm.c | 43 +++++++++++++++++++++++-------------------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/drivers/net/ipn3ke/ipn3ke_tm.c b/drivers/net/ipn3ke/ipn3ke_tm.c
index 4bcf3aa..30a3dfd 100644
--- a/drivers/net/ipn3ke/ipn3ke_tm.c
+++ b/drivers/net/ipn3ke/ipn3ke_tm.c
@@ -1579,7 +1579,8 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 
 static int
 ipn3ke_hw_tm_node_wr(struct ipn3ke_hw *hw,
-				struct ipn3ke_tm_node *n)
+	struct ipn3ke_tm_node *n,
+	struct ipn3ke_tm_node *parent_node)
 {
 	uint32_t level;
 
@@ -1650,11 +1651,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 		/**
 		 * Configure Map
 		 */
-		IPN3KE_MASK_WRITE_REG(hw,
-				IPN3KE_QOS_MAP_L2_X,
-				n->node_index,
-				n->parent_node->node_index,
-				IPN3KE_QOS_MAP_L2_MASK);
+		if (parent_node)
+			IPN3KE_MASK_WRITE_REG(hw,
+					IPN3KE_QOS_MAP_L2_X,
+					n->node_index,
+					parent_node->node_index,
+					IPN3KE_QOS_MAP_L2_MASK);
 
 		break;
 	case IPN3KE_TM_NODE_LEVEL_COS:
@@ -1707,11 +1709,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 					0x80000000))
 			;
 
-		IPN3KE_MASK_WRITE_REG(hw,
-			IPN3KE_QM_UID_CONFIG_DATA,
-			0,
-			(1 << 8 | n->parent_node->parent_node->node_index),
-			0x1FF);
+		if (parent_node && parent_node->parent_node)
+			IPN3KE_MASK_WRITE_REG(hw,
+				IPN3KE_QM_UID_CONFIG_DATA,
+				0,
+				(1 << 8 | parent_node->parent_node->node_index),
+				0x1FF);
 
 		IPN3KE_MASK_WRITE_REG(hw,
 				IPN3KE_QM_UID_CONFIG_CTRL,
@@ -1728,11 +1731,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 		/**
 		 * Configure Map
 		 */
-		IPN3KE_MASK_WRITE_REG(hw,
-				IPN3KE_QOS_MAP_L1_X,
-				n->node_index,
-				n->parent_node->node_index,
-				IPN3KE_QOS_MAP_L1_MASK);
+		if (parent_node)
+			IPN3KE_MASK_WRITE_REG(hw,
+					IPN3KE_QOS_MAP_L1_X,
+					n->node_index,
+					parent_node->node_index,
+					IPN3KE_QOS_MAP_L1_MASK);
 
 		break;
 	default:
@@ -1772,7 +1776,8 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 						NULL,
 						rte_strerror(EINVAL));
 		}
-		ipn3ke_hw_tm_node_wr(hw, n);
+		parent_node = n->parent_node;
+		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
 	}
 
 	nl = &tm->h.vt_commit_node_list;
@@ -1802,7 +1807,7 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 						NULL,
 						rte_strerror(EINVAL));
 		}
-		ipn3ke_hw_tm_node_wr(hw, n);
+		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
 	}
 
 	nl = &tm->h.cos_commit_node_list;
@@ -1836,7 +1841,7 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
 						NULL,
 						rte_strerror(EINVAL));
 		}
-		ipn3ke_hw_tm_node_wr(hw, n);
+		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
 	}
 
 	return 0;
-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference
  2019-05-23  4:31 [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference Andy Pei
@ 2019-05-23  5:20 ` Xu, Rosen
  2019-06-18 13:32   ` Zhang, Qi Z
  0 siblings, 1 reply; 3+ messages in thread
From: Xu, Rosen @ 2019-05-23  5:20 UTC (permalink / raw)
  To: Pei, Andy, dev; +Cc: stable



> -----Original Message-----
> From: Pei, Andy
> Sent: Thursday, May 23, 2019 12:31
> To: dev@dpdk.org
> Cc: Pei, Andy <andy.pei@intel.com>; Xu, Rosen <rosen.xu@intel.com>;
> stable@dpdk.org
> Subject: [PATCH] net/ipn3ke: fix null pointer dereference
> 
> In current code, scenario may happens that when function
> ipn3ke_hw_tm_node_wr is called, struct ipn3ke_tm_node n has a NULL
> element parent_node, however, the element parent_node of struct
> ipn3ke_tm_node n is used in an invalid way.
> After applying this patch,
> this null pointer dereference is avoided.
> 
> Coverity issue: 337921
> Fixes: c820468ac99c ("net/ipn3ke: support TM")
> Cc: rosen.xu@intel.com
> Cc: stable@dpdk.org
> 
> Signed-off-by: Andy Pei <andy.pei@intel.com>
> ---
>  drivers/net/ipn3ke/ipn3ke_tm.c | 43 +++++++++++++++++++++++---------------
> ----
>  1 file changed, 24 insertions(+), 19 deletions(-)
> 
> diff --git a/drivers/net/ipn3ke/ipn3ke_tm.c
> b/drivers/net/ipn3ke/ipn3ke_tm.c index 4bcf3aa..30a3dfd 100644
> --- a/drivers/net/ipn3ke/ipn3ke_tm.c
> +++ b/drivers/net/ipn3ke/ipn3ke_tm.c
> @@ -1579,7 +1579,8 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
> 
>  static int
>  ipn3ke_hw_tm_node_wr(struct ipn3ke_hw *hw,
> -				struct ipn3ke_tm_node *n)
> +	struct ipn3ke_tm_node *n,
> +	struct ipn3ke_tm_node *parent_node)
>  {
>  	uint32_t level;
> 
> @@ -1650,11 +1651,12 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
>  		/**
>  		 * Configure Map
>  		 */
> -		IPN3KE_MASK_WRITE_REG(hw,
> -				IPN3KE_QOS_MAP_L2_X,
> -				n->node_index,
> -				n->parent_node->node_index,
> -				IPN3KE_QOS_MAP_L2_MASK);
> +		if (parent_node)
> +			IPN3KE_MASK_WRITE_REG(hw,
> +					IPN3KE_QOS_MAP_L2_X,
> +					n->node_index,
> +					parent_node->node_index,
> +					IPN3KE_QOS_MAP_L2_MASK);
> 
>  		break;
>  	case IPN3KE_TM_NODE_LEVEL_COS:
> @@ -1707,11 +1709,12 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
>  					0x80000000))
>  			;
> 
> -		IPN3KE_MASK_WRITE_REG(hw,
> -			IPN3KE_QM_UID_CONFIG_DATA,
> -			0,
> -			(1 << 8 | n->parent_node->parent_node-
> >node_index),
> -			0x1FF);
> +		if (parent_node && parent_node->parent_node)
> +			IPN3KE_MASK_WRITE_REG(hw,
> +				IPN3KE_QM_UID_CONFIG_DATA,
> +				0,
> +				(1 << 8 | parent_node->parent_node-
> >node_index),
> +				0x1FF);
> 
>  		IPN3KE_MASK_WRITE_REG(hw,
>  				IPN3KE_QM_UID_CONFIG_CTRL,
> @@ -1728,11 +1731,12 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
>  		/**
>  		 * Configure Map
>  		 */
> -		IPN3KE_MASK_WRITE_REG(hw,
> -				IPN3KE_QOS_MAP_L1_X,
> -				n->node_index,
> -				n->parent_node->node_index,
> -				IPN3KE_QOS_MAP_L1_MASK);
> +		if (parent_node)
> +			IPN3KE_MASK_WRITE_REG(hw,
> +					IPN3KE_QOS_MAP_L1_X,
> +					n->node_index,
> +					parent_node->node_index,
> +					IPN3KE_QOS_MAP_L1_MASK);
> 
>  		break;
>  	default:
> @@ -1772,7 +1776,8 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
>  						NULL,
>  						rte_strerror(EINVAL));
>  		}
> -		ipn3ke_hw_tm_node_wr(hw, n);
> +		parent_node = n->parent_node;
> +		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
>  	}
> 
>  	nl = &tm->h.vt_commit_node_list;
> @@ -1802,7 +1807,7 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
>  						NULL,
>  						rte_strerror(EINVAL));
>  		}
> -		ipn3ke_hw_tm_node_wr(hw, n);
> +		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
>  	}
> 
>  	nl = &tm->h.cos_commit_node_list;
> @@ -1836,7 +1841,7 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
>  						NULL,
>  						rte_strerror(EINVAL));
>  		}
> -		ipn3ke_hw_tm_node_wr(hw, n);
> +		ipn3ke_hw_tm_node_wr(hw, n, parent_node);
>  	}
> 
>  	return 0;
> --
> 1.8.3.1

Acked-by: Rosen Xu <rosen.xu@intel.com>

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference
  2019-05-23  5:20 ` Xu, Rosen
@ 2019-06-18 13:32   ` Zhang, Qi Z
  0 siblings, 0 replies; 3+ messages in thread
From: Zhang, Qi Z @ 2019-06-18 13:32 UTC (permalink / raw)
  To: Xu, Rosen, Pei, Andy, dev; +Cc: stable



> -----Original Message-----
> From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Xu, Rosen
> Sent: Thursday, May 23, 2019 1:20 PM
> To: Pei, Andy <andy.pei@intel.com>; dev@dpdk.org
> Cc: stable@dpdk.org
> Subject: Re: [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference
> 
> 
> 
> > -----Original Message-----
> > From: Pei, Andy
> > Sent: Thursday, May 23, 2019 12:31
> > To: dev@dpdk.org
> > Cc: Pei, Andy <andy.pei@intel.com>; Xu, Rosen <rosen.xu@intel.com>;
> > stable@dpdk.org
> > Subject: [PATCH] net/ipn3ke: fix null pointer dereference
> >
> > In current code, scenario may happens that when function
> > ipn3ke_hw_tm_node_wr is called, struct ipn3ke_tm_node n has a NULL
> > element parent_node, however, the element parent_node of struct
> > ipn3ke_tm_node n is used in an invalid way.
> > After applying this patch,
> > this null pointer dereference is avoided.
> >
> > Coverity issue: 337921
> > Fixes: c820468ac99c ("net/ipn3ke: support TM")
> > Cc: rosen.xu@intel.com
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Andy Pei <andy.pei@intel.com>
> > ---
> Acked-by: Rosen Xu <rosen.xu@intel.com>

Applied to dpdk-next-net-intel.

Thanks
Qi

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-23  4:31 [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference Andy Pei
2019-05-23  5:20 ` Xu, Rosen
2019-06-18 13:32   ` Zhang, Qi Z

DPDK-dev Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/dpdk-dev/0 dpdk-dev/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 dpdk-dev dpdk-dev/ https://lore.kernel.org/dpdk-dev \
		dev@dpdk.org dpdk-dev@archiver.kernel.org
	public-inbox-index dpdk-dev


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.dpdk.dev


AGPL code for this site: git clone https://public-inbox.org/ public-inbox