[v1,2/6] baseband/acc: fix to possible overflow
Checks
Commit Message
Potential overflow issue when casting to 64bits,
notably relevant when extending number of queues.
Coverity issue: 381665
Fixes: 32e8b7ea35 ("baseband/acc100: refactor to segregate common code")
Fixes: 40e3adbdd3 ("baseband/acc200: add queue configuration")
Signed-off-by: Nicolas Chautru <nicolas.chautru@intel.com>
---
drivers/baseband/acc/rte_acc100_pmd.c | 3 +--
drivers/baseband/acc/rte_acc200_pmd.c | 2 +-
2 files changed, 2 insertions(+), 3 deletions(-)
Comments
On 11/2/22 00:04, Nicolas Chautru wrote:
> Potential overflow issue when casting to 64bits,
> notably relevant when extending number of queues.
>
> Coverity issue: 381665
> Fixes: 32e8b7ea35 ("baseband/acc100: refactor to segregate common code")
> Fixes: 40e3adbdd3 ("baseband/acc200: add queue configuration")
>
> Signed-off-by: Nicolas Chautru <nicolas.chautru@intel.com>
> ---
> drivers/baseband/acc/rte_acc100_pmd.c | 3 +--
> drivers/baseband/acc/rte_acc200_pmd.c | 2 +-
> 2 files changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/baseband/acc/rte_acc100_pmd.c b/drivers/baseband/acc/rte_acc100_pmd.c
> index 23bc5d25bb..b6e500c6bc 100644
> --- a/drivers/baseband/acc/rte_acc100_pmd.c
> +++ b/drivers/baseband/acc/rte_acc100_pmd.c
> @@ -888,8 +888,7 @@ acc100_queue_release(struct rte_bbdev *dev, uint16_t q_id)
>
> if (q != NULL) {
> /* Mark the Queue as un-assigned */
> - d->q_assigned_bit_map[q->qgrp_id] &= (0xFFFFFFFFFFFFFFFF -
> - (uint64_t) (1 << q->aq_id));
> + d->q_assigned_bit_map[q->qgrp_id] &= (~0ULL - (1 << (uint64_t) q->aq_id));
> rte_free(q->companion_ring_addr);
> rte_free(q->lb_in);
> rte_free(q->lb_out);
> diff --git a/drivers/baseband/acc/rte_acc200_pmd.c b/drivers/baseband/acc/rte_acc200_pmd.c
> index 0cbb9a946b..76a5986448 100644
> --- a/drivers/baseband/acc/rte_acc200_pmd.c
> +++ b/drivers/baseband/acc/rte_acc200_pmd.c
> @@ -964,7 +964,7 @@ acc200_queue_release(struct rte_bbdev *dev, uint16_t q_id)
>
> if (q != NULL) {
> /* Mark the Queue as un-assigned. */
> - d->q_assigned_bit_map[q->qgrp_id] &= (~0ULL - (uint64_t) (1 << q->aq_id));
> + d->q_assigned_bit_map[q->qgrp_id] &= (~0ULL - (1 << (uint64_t) q->aq_id));
> rte_free(q->companion_ring_addr);
> rte_free(q->lb_in);
> rte_free(q->lb_out);
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Thanks,
Maxime
@@ -888,8 +888,7 @@ acc100_queue_release(struct rte_bbdev *dev, uint16_t q_id)
if (q != NULL) {
/* Mark the Queue as un-assigned */
- d->q_assigned_bit_map[q->qgrp_id] &= (0xFFFFFFFFFFFFFFFF -
- (uint64_t) (1 << q->aq_id));
+ d->q_assigned_bit_map[q->qgrp_id] &= (~0ULL - (1 << (uint64_t) q->aq_id));
rte_free(q->companion_ring_addr);
rte_free(q->lb_in);
rte_free(q->lb_out);
@@ -964,7 +964,7 @@ acc200_queue_release(struct rte_bbdev *dev, uint16_t q_id)
if (q != NULL) {
/* Mark the Queue as un-assigned. */
- d->q_assigned_bit_map[q->qgrp_id] &= (~0ULL - (uint64_t) (1 << q->aq_id));
+ d->q_assigned_bit_map[q->qgrp_id] &= (~0ULL - (1 << (uint64_t) q->aq_id));
rte_free(q->companion_ring_addr);
rte_free(q->lb_in);
rte_free(q->lb_out);