[v1,1/9] baseband/acc: protection for TB negative scenario
Checks
Commit Message
Adding handling of negative scenario for malformed
Transport Block mode operations.
Fixes: bec597b78a0 ("baseband/acc200: add LTE processing")
Cc: stable@dpdk.org
Signed-off-by: Nicolas Chautru <nicolas.chautru@intel.com>
---
drivers/baseband/acc/rte_vrb_pmd.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
Comments
On 2/9/23 23:19, Nicolas Chautru wrote:
> Adding handling of negative scenario for malformed
> Transport Block mode operations.
>
> Fixes: bec597b78a0 ("baseband/acc200: add LTE processing")
> Cc: stable@dpdk.org
>
> Signed-off-by: Nicolas Chautru <nicolas.chautru@intel.com>
> ---
> drivers/baseband/acc/rte_vrb_pmd.c | 20 ++++++++++++++++++++
> 1 file changed, 20 insertions(+)
>
> diff --git a/drivers/baseband/acc/rte_vrb_pmd.c b/drivers/baseband/acc/rte_vrb_pmd.c
> index 34e42d1f6e..797330a5dd 100644
> --- a/drivers/baseband/acc/rte_vrb_pmd.c
> +++ b/drivers/baseband/acc/rte_vrb_pmd.c
> @@ -1820,6 +1820,9 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
> r = op->turbo_enc.tb_params.r;
>
> while (mbuf_total_left > 0 && r < c) {
> + if (unlikely((input == NULL) || (output == NULL)))
> + return -1;
> +
> seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
> /* Set up DMA descriptor */
> desc = acc_desc(q, total_enqueued_cbs);
> @@ -1854,6 +1857,10 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
> r++;
> }
>
> + /* In case the number of CB doesn't match, the configuration was invalid. */
> + if (current_enqueued_cbs != cbs_in_tb)
Maybe wrap it with unlikely()?
> + return -1;
> +
> /* Set SDone on last CB descriptor for TB mode. */
> desc->req.sdone_enable = 1;
>
> @@ -2100,6 +2107,9 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
> }
>
> while (mbuf_total_left > 0 && r < c) {
> + if (unlikely((input == NULL) || (h_output == NULL)))
> + return -1;
> +
> if (check_bit(op->ldpc_dec.op_flags, RTE_BBDEV_LDPC_DEC_SCATTER_GATHER))
> seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
> else
> @@ -2145,6 +2155,10 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
> r++;
> }
>
> + /* In case the number of CB doesn't match, the configuration was invalid. */
> + if (current_enqueued_cbs != cbs_in_tb)
> + return -1;
> +
> #ifdef RTE_LIBRTE_BBDEV_DEBUG
> if (check_mbuf_total_left(mbuf_total_left) != 0)
> return -EINVAL;
> @@ -2187,6 +2201,8 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
> r = op->turbo_dec.tb_params.r;
>
> while (mbuf_total_left > 0 && r < c) {
> + if (unlikely((input == NULL) || (h_output == NULL)))
> + return -1;
>
> seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
>
> @@ -2237,6 +2253,10 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
> r++;
> }
>
> + /* In case the number of CB doesn't match, the configuration was invalid. */
> + if (current_enqueued_cbs != cbs_in_tb)
> + return -1;
> +
> /* Set SDone on last CB descriptor for TB mode */
> desc->req.sdone_enable = 1;
>
Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
Thanks,
Maxime
Hi Maxime,
Thanks, will do in v2.
> -----Original Message-----
> From: Maxime Coquelin <maxime.coquelin@redhat.com>
> Sent: Friday, February 10, 2023 12:17 AM
> To: Chautru, Nicolas <nicolas.chautru@intel.com>; dev@dpdk.org
> Cc: Vargas, Hernan <hernan.vargas@intel.com>; stable@dpdk.org
> Subject: Re: [PATCH v1 1/9] baseband/acc: protection for TB negative scenario
>
>
>
> On 2/9/23 23:19, Nicolas Chautru wrote:
> > Adding handling of negative scenario for malformed Transport Block
> > mode operations.
> >
> > Fixes: bec597b78a0 ("baseband/acc200: add LTE processing")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Nicolas Chautru <nicolas.chautru@intel.com>
> > ---
> > drivers/baseband/acc/rte_vrb_pmd.c | 20 ++++++++++++++++++++
> > 1 file changed, 20 insertions(+)
> >
> > diff --git a/drivers/baseband/acc/rte_vrb_pmd.c
> > b/drivers/baseband/acc/rte_vrb_pmd.c
> > index 34e42d1f6e..797330a5dd 100644
> > --- a/drivers/baseband/acc/rte_vrb_pmd.c
> > +++ b/drivers/baseband/acc/rte_vrb_pmd.c
> > @@ -1820,6 +1820,9 @@ enqueue_enc_one_op_tb(struct acc_queue *q,
> struct rte_bbdev_enc_op *op,
> > r = op->turbo_enc.tb_params.r;
> >
> > while (mbuf_total_left > 0 && r < c) {
> > + if (unlikely((input == NULL) || (output == NULL)))
> > + return -1;
> > +
> > seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
> > /* Set up DMA descriptor */
> > desc = acc_desc(q, total_enqueued_cbs); @@ -1854,6
> +1857,10 @@
> > enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op
> *op,
> > r++;
> > }
> >
> > + /* In case the number of CB doesn't match, the configuration was
> invalid. */
> > + if (current_enqueued_cbs != cbs_in_tb)
>
> Maybe wrap it with unlikely()?
>
> > + return -1;
> > +
> > /* Set SDone on last CB descriptor for TB mode. */
> > desc->req.sdone_enable = 1;
> >
> > @@ -2100,6 +2107,9 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct
> acc_queue *q, struct rte_bbdev_dec_op *op,
> > }
> >
> > while (mbuf_total_left > 0 && r < c) {
> > + if (unlikely((input == NULL) || (h_output == NULL)))
> > + return -1;
> > +
> > if (check_bit(op->ldpc_dec.op_flags,
> RTE_BBDEV_LDPC_DEC_SCATTER_GATHER))
> > seg_total_left = rte_pktmbuf_data_len(input) -
> in_offset;
> > else
> > @@ -2145,6 +2155,10 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct
> acc_queue *q, struct rte_bbdev_dec_op *op,
> > r++;
> > }
> >
> > + /* In case the number of CB doesn't match, the configuration was
> invalid. */
> > + if (current_enqueued_cbs != cbs_in_tb)
> > + return -1;
> > +
> > #ifdef RTE_LIBRTE_BBDEV_DEBUG
> > if (check_mbuf_total_left(mbuf_total_left) != 0)
> > return -EINVAL;
> > @@ -2187,6 +2201,8 @@ enqueue_dec_one_op_tb(struct acc_queue *q,
> struct rte_bbdev_dec_op *op,
> > r = op->turbo_dec.tb_params.r;
> >
> > while (mbuf_total_left > 0 && r < c) {
> > + if (unlikely((input == NULL) || (h_output == NULL)))
> > + return -1;
> >
> > seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
> >
> > @@ -2237,6 +2253,10 @@ enqueue_dec_one_op_tb(struct acc_queue *q,
> struct rte_bbdev_dec_op *op,
> > r++;
> > }
> >
> > + /* In case the number of CB doesn't match, the configuration was
> invalid. */
> > + if (current_enqueued_cbs != cbs_in_tb)
> > + return -1;
> > +
> > /* Set SDone on last CB descriptor for TB mode */
> > desc->req.sdone_enable = 1;
> >
>
> Reviewed-by: Maxime Coquelin <maxime.coquelin@redhat.com>
>
> Thanks,
> Maxime
@@ -1820,6 +1820,9 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
r = op->turbo_enc.tb_params.r;
while (mbuf_total_left > 0 && r < c) {
+ if (unlikely((input == NULL) || (output == NULL)))
+ return -1;
+
seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
/* Set up DMA descriptor */
desc = acc_desc(q, total_enqueued_cbs);
@@ -1854,6 +1857,10 @@ enqueue_enc_one_op_tb(struct acc_queue *q, struct rte_bbdev_enc_op *op,
r++;
}
+ /* In case the number of CB doesn't match, the configuration was invalid. */
+ if (current_enqueued_cbs != cbs_in_tb)
+ return -1;
+
/* Set SDone on last CB descriptor for TB mode. */
desc->req.sdone_enable = 1;
@@ -2100,6 +2107,9 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
}
while (mbuf_total_left > 0 && r < c) {
+ if (unlikely((input == NULL) || (h_output == NULL)))
+ return -1;
+
if (check_bit(op->ldpc_dec.op_flags, RTE_BBDEV_LDPC_DEC_SCATTER_GATHER))
seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
else
@@ -2145,6 +2155,10 @@ vrb_enqueue_ldpc_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
r++;
}
+ /* In case the number of CB doesn't match, the configuration was invalid. */
+ if (current_enqueued_cbs != cbs_in_tb)
+ return -1;
+
#ifdef RTE_LIBRTE_BBDEV_DEBUG
if (check_mbuf_total_left(mbuf_total_left) != 0)
return -EINVAL;
@@ -2187,6 +2201,8 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
r = op->turbo_dec.tb_params.r;
while (mbuf_total_left > 0 && r < c) {
+ if (unlikely((input == NULL) || (h_output == NULL)))
+ return -1;
seg_total_left = rte_pktmbuf_data_len(input) - in_offset;
@@ -2237,6 +2253,10 @@ enqueue_dec_one_op_tb(struct acc_queue *q, struct rte_bbdev_dec_op *op,
r++;
}
+ /* In case the number of CB doesn't match, the configuration was invalid. */
+ if (current_enqueued_cbs != cbs_in_tb)
+ return -1;
+
/* Set SDone on last CB descriptor for TB mode */
desc->req.sdone_enable = 1;