net/ipn3ke: fix null pointer dereference
Checks
Commit Message
In current code, scenario may happens that
when function ipn3ke_hw_tm_node_wr is called,
struct ipn3ke_tm_node n has a NULL element
parent_node, however, the element parent_node
of struct ipn3ke_tm_node n is used in an invalid way.
After applying this patch,
this null pointer dereference is avoided.
Coverity issue: 337921
Fixes: c820468ac99c ("net/ipn3ke: support TM")
Cc: rosen.xu@intel.com
Cc: stable@dpdk.org
Signed-off-by: Andy Pei <andy.pei@intel.com>
---
drivers/net/ipn3ke/ipn3ke_tm.c | 43 +++++++++++++++++++++++-------------------
1 file changed, 24 insertions(+), 19 deletions(-)
Comments
> -----Original Message-----
> From: Pei, Andy
> Sent: Thursday, May 23, 2019 12:31
> To: dev@dpdk.org
> Cc: Pei, Andy <andy.pei@intel.com>; Xu, Rosen <rosen.xu@intel.com>;
> stable@dpdk.org
> Subject: [PATCH] net/ipn3ke: fix null pointer dereference
>
> In current code, scenario may happens that when function
> ipn3ke_hw_tm_node_wr is called, struct ipn3ke_tm_node n has a NULL
> element parent_node, however, the element parent_node of struct
> ipn3ke_tm_node n is used in an invalid way.
> After applying this patch,
> this null pointer dereference is avoided.
>
> Coverity issue: 337921
> Fixes: c820468ac99c ("net/ipn3ke: support TM")
> Cc: rosen.xu@intel.com
> Cc: stable@dpdk.org
>
> Signed-off-by: Andy Pei <andy.pei@intel.com>
> ---
> drivers/net/ipn3ke/ipn3ke_tm.c | 43 +++++++++++++++++++++++---------------
> ----
> 1 file changed, 24 insertions(+), 19 deletions(-)
>
> diff --git a/drivers/net/ipn3ke/ipn3ke_tm.c
> b/drivers/net/ipn3ke/ipn3ke_tm.c index 4bcf3aa..30a3dfd 100644
> --- a/drivers/net/ipn3ke/ipn3ke_tm.c
> +++ b/drivers/net/ipn3ke/ipn3ke_tm.c
> @@ -1579,7 +1579,8 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
>
> static int
> ipn3ke_hw_tm_node_wr(struct ipn3ke_hw *hw,
> - struct ipn3ke_tm_node *n)
> + struct ipn3ke_tm_node *n,
> + struct ipn3ke_tm_node *parent_node)
> {
> uint32_t level;
>
> @@ -1650,11 +1651,12 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
> /**
> * Configure Map
> */
> - IPN3KE_MASK_WRITE_REG(hw,
> - IPN3KE_QOS_MAP_L2_X,
> - n->node_index,
> - n->parent_node->node_index,
> - IPN3KE_QOS_MAP_L2_MASK);
> + if (parent_node)
> + IPN3KE_MASK_WRITE_REG(hw,
> + IPN3KE_QOS_MAP_L2_X,
> + n->node_index,
> + parent_node->node_index,
> + IPN3KE_QOS_MAP_L2_MASK);
>
> break;
> case IPN3KE_TM_NODE_LEVEL_COS:
> @@ -1707,11 +1709,12 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
> 0x80000000))
> ;
>
> - IPN3KE_MASK_WRITE_REG(hw,
> - IPN3KE_QM_UID_CONFIG_DATA,
> - 0,
> - (1 << 8 | n->parent_node->parent_node-
> >node_index),
> - 0x1FF);
> + if (parent_node && parent_node->parent_node)
> + IPN3KE_MASK_WRITE_REG(hw,
> + IPN3KE_QM_UID_CONFIG_DATA,
> + 0,
> + (1 << 8 | parent_node->parent_node-
> >node_index),
> + 0x1FF);
>
> IPN3KE_MASK_WRITE_REG(hw,
> IPN3KE_QM_UID_CONFIG_CTRL,
> @@ -1728,11 +1731,12 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
> /**
> * Configure Map
> */
> - IPN3KE_MASK_WRITE_REG(hw,
> - IPN3KE_QOS_MAP_L1_X,
> - n->node_index,
> - n->parent_node->node_index,
> - IPN3KE_QOS_MAP_L1_MASK);
> + if (parent_node)
> + IPN3KE_MASK_WRITE_REG(hw,
> + IPN3KE_QOS_MAP_L1_X,
> + n->node_index,
> + parent_node->node_index,
> + IPN3KE_QOS_MAP_L1_MASK);
>
> break;
> default:
> @@ -1772,7 +1776,8 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
> NULL,
> rte_strerror(EINVAL));
> }
> - ipn3ke_hw_tm_node_wr(hw, n);
> + parent_node = n->parent_node;
> + ipn3ke_hw_tm_node_wr(hw, n, parent_node);
> }
>
> nl = &tm->h.vt_commit_node_list;
> @@ -1802,7 +1807,7 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
> NULL,
> rte_strerror(EINVAL));
> }
> - ipn3ke_hw_tm_node_wr(hw, n);
> + ipn3ke_hw_tm_node_wr(hw, n, parent_node);
> }
>
> nl = &tm->h.cos_commit_node_list;
> @@ -1836,7 +1841,7 @@ struct ipn3ke_tm_shaper_params_range_type
> ipn3ke_tm_shaper_params_rang[] = {
> NULL,
> rte_strerror(EINVAL));
> }
> - ipn3ke_hw_tm_node_wr(hw, n);
> + ipn3ke_hw_tm_node_wr(hw, n, parent_node);
> }
>
> return 0;
> --
> 1.8.3.1
Acked-by: Rosen Xu <rosen.xu@intel.com>
> -----Original Message-----
> From: dev [mailto:dev-bounces@dpdk.org] On Behalf Of Xu, Rosen
> Sent: Thursday, May 23, 2019 1:20 PM
> To: Pei, Andy <andy.pei@intel.com>; dev@dpdk.org
> Cc: stable@dpdk.org
> Subject: Re: [dpdk-dev] [PATCH] net/ipn3ke: fix null pointer dereference
>
>
>
> > -----Original Message-----
> > From: Pei, Andy
> > Sent: Thursday, May 23, 2019 12:31
> > To: dev@dpdk.org
> > Cc: Pei, Andy <andy.pei@intel.com>; Xu, Rosen <rosen.xu@intel.com>;
> > stable@dpdk.org
> > Subject: [PATCH] net/ipn3ke: fix null pointer dereference
> >
> > In current code, scenario may happens that when function
> > ipn3ke_hw_tm_node_wr is called, struct ipn3ke_tm_node n has a NULL
> > element parent_node, however, the element parent_node of struct
> > ipn3ke_tm_node n is used in an invalid way.
> > After applying this patch,
> > this null pointer dereference is avoided.
> >
> > Coverity issue: 337921
> > Fixes: c820468ac99c ("net/ipn3ke: support TM")
> > Cc: rosen.xu@intel.com
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Andy Pei <andy.pei@intel.com>
> > ---
> Acked-by: Rosen Xu <rosen.xu@intel.com>
Applied to dpdk-next-net-intel.
Thanks
Qi
@@ -1579,7 +1579,8 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
static int
ipn3ke_hw_tm_node_wr(struct ipn3ke_hw *hw,
- struct ipn3ke_tm_node *n)
+ struct ipn3ke_tm_node *n,
+ struct ipn3ke_tm_node *parent_node)
{
uint32_t level;
@@ -1650,11 +1651,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
/**
* Configure Map
*/
- IPN3KE_MASK_WRITE_REG(hw,
- IPN3KE_QOS_MAP_L2_X,
- n->node_index,
- n->parent_node->node_index,
- IPN3KE_QOS_MAP_L2_MASK);
+ if (parent_node)
+ IPN3KE_MASK_WRITE_REG(hw,
+ IPN3KE_QOS_MAP_L2_X,
+ n->node_index,
+ parent_node->node_index,
+ IPN3KE_QOS_MAP_L2_MASK);
break;
case IPN3KE_TM_NODE_LEVEL_COS:
@@ -1707,11 +1709,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
0x80000000))
;
- IPN3KE_MASK_WRITE_REG(hw,
- IPN3KE_QM_UID_CONFIG_DATA,
- 0,
- (1 << 8 | n->parent_node->parent_node->node_index),
- 0x1FF);
+ if (parent_node && parent_node->parent_node)
+ IPN3KE_MASK_WRITE_REG(hw,
+ IPN3KE_QM_UID_CONFIG_DATA,
+ 0,
+ (1 << 8 | parent_node->parent_node->node_index),
+ 0x1FF);
IPN3KE_MASK_WRITE_REG(hw,
IPN3KE_QM_UID_CONFIG_CTRL,
@@ -1728,11 +1731,12 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
/**
* Configure Map
*/
- IPN3KE_MASK_WRITE_REG(hw,
- IPN3KE_QOS_MAP_L1_X,
- n->node_index,
- n->parent_node->node_index,
- IPN3KE_QOS_MAP_L1_MASK);
+ if (parent_node)
+ IPN3KE_MASK_WRITE_REG(hw,
+ IPN3KE_QOS_MAP_L1_X,
+ n->node_index,
+ parent_node->node_index,
+ IPN3KE_QOS_MAP_L1_MASK);
break;
default:
@@ -1772,7 +1776,8 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
NULL,
rte_strerror(EINVAL));
}
- ipn3ke_hw_tm_node_wr(hw, n);
+ parent_node = n->parent_node;
+ ipn3ke_hw_tm_node_wr(hw, n, parent_node);
}
nl = &tm->h.vt_commit_node_list;
@@ -1802,7 +1807,7 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
NULL,
rte_strerror(EINVAL));
}
- ipn3ke_hw_tm_node_wr(hw, n);
+ ipn3ke_hw_tm_node_wr(hw, n, parent_node);
}
nl = &tm->h.cos_commit_node_list;
@@ -1836,7 +1841,7 @@ struct ipn3ke_tm_shaper_params_range_type ipn3ke_tm_shaper_params_rang[] = {
NULL,
rte_strerror(EINVAL));
}
- ipn3ke_hw_tm_node_wr(hw, n);
+ ipn3ke_hw_tm_node_wr(hw, n, parent_node);
}
return 0;