From patchwork Tue Mar 3 17:59:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 66219 X-Patchwork-Delegate: ajit.khaparde@broadcom.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7DD9BA0571; Tue, 3 Mar 2020 18:59:52 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 03F811C00E; Tue, 3 Mar 2020 18:59:45 +0100 (CET) Received: from mail-pf1-f194.google.com (mail-pf1-f194.google.com [209.85.210.194]) by dpdk.org (Postfix) with ESMTP id AC71E1BFF4 for ; Tue, 3 Mar 2020 18:59:43 +0100 (CET) Received: by mail-pf1-f194.google.com with SMTP id 2so1830000pfg.12 for ; Tue, 03 Mar 2020 09:59:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=hTbR+MUCuQl/XjF9vP0peDzMe488+txf/Crskfsat+w=; b=rWnj2Qi2n/bFjMoFmr2MqPqa27wEu93lFDnvoNJAnXy3IvogRYrRtOKI5Kjyaa/lNb JwmgaCXyyZTJGNr9JCmx25BjnM4bKvram200hHEP/+7Fhw4m9d9wSb6NmG4MtDSEDwga E4ZjwUoTzMv+2tdJL84YDBsqbiQbleY3iYFe/M7LjHHpfk/V6OifFw2jXKSG1n1k3PrV tjcerweIQARxAxejxLzyA9SPebZlLT6+e+HVqxeh32LxqgQDmRMwXTRdGTWLWGmR7R8B oVlrkaXoMXTN7LY2AV680lSoEb3tifnznyicwkrdZPsWBSSuv3SNa963qe7z+LOnr4uy 076A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=hTbR+MUCuQl/XjF9vP0peDzMe488+txf/Crskfsat+w=; b=ncXg7cDw2VQ4sbZYFHc7rLxMY18lCsnUfykKJMpoZ/BajfI/SnWkEXXhEsLfddaH/r TmUQt/XINin0WMyTkiSaCHaQxNeFWBJ0fYJAKuQyZPSluj5Uw1ittVe2rcc595d1cGXb Vf1dFDkpmh9eyT2xoaU1QSvPh0yLn1c3ByqN/WVrwW4XDR4zWEsiyIC4SWxXkWJYB9pU xaN6xagMvybtCkYd+VyUwm137RTkPHSJZHohS2RGCePRVXS1XCqVv1YWNH5DpVFgROp8 0DQmBQJ8mUEejp5BMcginWM+2CNTWs+ze/ebrgI7incK9cxnq/j5Raiso5BYaS6ZgSr3 BVnA== X-Gm-Message-State: ANhLgQ3Ss6BCjPw7hmHEyXg0n8d0l657AGSDTmAhKAPlUXQ/AQd6zwH+ BlNj/KGqjNW1WhFZlghLS/Y+kQ== X-Google-Smtp-Source: ADFU+vtJR/SwUVeYxn1xovxIzjRjxgxDqsd8bmfIqYhxJQchQPJNkPZKxsxPWS6KOYqUEhTsxx1tEQ== X-Received: by 2002:a62:1a03:: with SMTP id a3mr3985027pfa.214.1583258382707; Tue, 03 Mar 2020 09:59:42 -0800 (PST) Received: from hermes.corp.microsoft.com (204-195-22-127.wavecable.com. [204.195.22.127]) by smtp.gmail.com with ESMTPSA id w195sm22012158pfd.65.2020.03.03.09.59.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Mar 2020 09:59:41 -0800 (PST) From: Stephen Hemminger To: ajit.khaparde@broadcom.com, somnath.kotur@broadcom.com Cc: dev@dpdk.org, Stephen Hemminger Date: Tue, 3 Mar 2020 09:59:33 -0800 Message-Id: <20200303175938.14292-2-stephen@networkplumber.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200303175938.14292-1-stephen@networkplumber.org> References: <20200303175938.14292-1-stephen@networkplumber.org> MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH 1/6] eal: add portable way to check for math overflow X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Clang and recent versions of GCC has builtin functions to do most math operations and check for wraparound. On most architectures this is a just a math operation followed by a branch on carry set. But DPDK needs to be able to handle older GCC versions, and other compilers so a wrapper macro is needed. Chose to use a macro instead of inline functions to avoid having to write lots of variants for each numeric type. Signed-off-by: Stephen Hemminger --- lib/librte_eal/common/Makefile | 2 +- lib/librte_eal/common/include/rte_overflow.h | 74 ++++++++++++++++++++ 2 files changed, 75 insertions(+), 1 deletion(-) create mode 100644 lib/librte_eal/common/include/rte_overflow.h diff --git a/lib/librte_eal/common/Makefile b/lib/librte_eal/common/Makefile index c2c6d92cd377..3794128b75b7 100644 --- a/lib/librte_eal/common/Makefile +++ b/lib/librte_eal/common/Makefile @@ -13,7 +13,7 @@ INC += rte_tailq.h rte_interrupts.h rte_alarm.h INC += rte_string_fns.h rte_version.h INC += rte_eal_memconfig.h INC += rte_hexdump.h rte_devargs.h rte_bus.h rte_dev.h rte_class.h -INC += rte_option.h +INC += rte_option.h rte_overflow.h INC += rte_pci_dev_feature_defs.h rte_pci_dev_features.h INC += rte_malloc.h rte_keepalive.h rte_time.h INC += rte_service.h rte_service_component.h diff --git a/lib/librte_eal/common/include/rte_overflow.h b/lib/librte_eal/common/include/rte_overflow.h new file mode 100644 index 000000000000..d61791371029 --- /dev/null +++ b/lib/librte_eal/common/include/rte_overflow.h @@ -0,0 +1,74 @@ +/* SPDX-License-Identifier: BSD-3-Clause + * Copyright(c) 2020 Microsoft Corp + */ +#ifndef RTE_OVERFLOW_H_ +#define RTE_OVERFLOW_H_ +/** + * @file + * + * Math functions with overflow checking. + * Wrappers for the __builtin_XXX_overflow functions that exist + * in recent versions of GCC and CLANG but may not exist + * in older compilers. They are macros to allow use with any + * size of unsigned number. + * + * See: + * https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html + * https://github.com/nemequ/portable-snippets/tree/master/safe-math + */ + +#ifdef __cplusplus +extern "C" { +#endif + +#include + +#if defined(__has_builtin) +# if __has_builtin(__builtin_add_overflow) +# define RTE_HAVE_BUILTIN_OVERFLOW +# endif +#elif defined(RTE_TOOLCHAIN_GCC) && (GCC_VERSION >= 5000) +# define RTE__HAVE_BUILTIN_OVERFLOW +#endif + +/** + * Safely add two bit unsigned numbers + * @param a + * One operand + * @param b + * Other operand + * @param res + * Pointer to the where result of a + b is stored. + * Must not be NULL + * @return + * return true if the result overflows and is therefore truncated. + */ +#ifdef RTE_HAVE_BUILTIN_OVERFLOW +#define rte_add_overflow(a, b, res) __builtin_add_overflow(a, b, res) +#else +#define rte_add_overflow(a, b, res) ({ *res = a + b; *res < a; }) +#endif + +/** + * Safely multiply two unsigned numbers + * @param a + * One operand + * @param b + * Other operand + * @param res + * Pointer to the where result of a + b is stored. + * Must not be NULL + * @return + * return true if the result overflows and is therefore truncated. + */ +#ifdef RTE_HAVE_BUILTIN_OVERFLOW +#define rte_mul_overflow(a, b, res) __builtin_mul_overflow(a, b, res) +#else +#define rte_mul_overflow(a, b, res) ({ *res = a * b; *res < a; }) +#endif + +#ifdef __cplusplus +} +#endif + +#endif /* RTE_OVERFLOW_H_ */ From patchwork Tue Mar 3 17:59:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 66220 X-Patchwork-Delegate: ajit.khaparde@broadcom.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 92A30A0571; Tue, 3 Mar 2020 19:00:02 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 32F231C01E; Tue, 3 Mar 2020 18:59:47 +0100 (CET) Received: from mail-pl1-f194.google.com (mail-pl1-f194.google.com [209.85.214.194]) by dpdk.org (Postfix) with ESMTP id 399AE1C012 for ; Tue, 3 Mar 2020 18:59:45 +0100 (CET) Received: by mail-pl1-f194.google.com with SMTP id x17so1650679plm.10 for ; Tue, 03 Mar 2020 09:59:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=ap7V2Mf+iyDGYa/E3yDLrfkvs2vTi+qaq5RjdBx02GI=; b=nx5yDPYm/pMHc2xS13NUa7EyIccW9H/N1n7Vv4Ud6rn8vIXjItKi4wSgHDQKBv9bJ1 cdq7G0O1CJrD4U3R2dHEd6fE2ssQkQ7RRcYHzh6GQ/t1rKf9LJXqQutfbsCuXUEhyexQ cZeI5g7owkpwxvIS+owyZ1jdqdVyQQ84sXaR8n1c6/yCyf1htMK78p8W6gT6kQH7o4JJ MnCVHe9W8chGt8cySi9JSSqK+nGhgq3gEITkHIAqevjAGnN3yrg4rpMy7nyxXRTmvfau 6/i/gVXhaLUJhOC/sS7+Xba6C3s/p4v6iNy2G7ZOwosIPmcdEpRW3xL4pZr06l/NfYhi 0Eiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=ap7V2Mf+iyDGYa/E3yDLrfkvs2vTi+qaq5RjdBx02GI=; b=mVSrQiDLaVIbLxaKt/x1jhqjKx7OF+SCIM50SVFVaetEm+BzfQkFn7+fCIZdAdZ4Lv 5Orqo5Vev9T9DM0x/Z97SP2Iw1sUm52HcUx40WQf6rspEQQASY6h8L1DXlDtuOhBTomu iliVHe3p81FlJq50D8W6kxYtGBQVp/rtKXUnjL32b40ACKXl8GiQFtg52I3JP50YP6lK 3EbSIy6y3CKulNEUWNw6xVlMtUonylqCtaS5fT7745UseoXLJnZKUCT875u7zvJLGOIx DvQ6tCbWaGn9URYZV01iDAoIZMXYOHAXmk9qI8tiB8ECcG1oxtqC91MnbbYeCTrXbsIX +4Tg== X-Gm-Message-State: ANhLgQ0WGw0der50tkqdz2bEH6P0zicERc61tsSJpvPXpd0cUJ3T6Cc4 kMifMNOPswxU82Qbv1rjD+3UqQ== X-Google-Smtp-Source: ADFU+vszG4Tl9g6BK9+TPRqQHfP97LGzXul9b+EVQmtTgioRn8K1uzoPaI8I9SXSPOhC45tineW2iQ== X-Received: by 2002:a17:90b:94d:: with SMTP id dw13mr5349368pjb.13.1583258384181; Tue, 03 Mar 2020 09:59:44 -0800 (PST) Received: from hermes.corp.microsoft.com (204-195-22-127.wavecable.com. [204.195.22.127]) by smtp.gmail.com with ESMTPSA id w195sm22012158pfd.65.2020.03.03.09.59.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Mar 2020 09:59:43 -0800 (PST) From: Stephen Hemminger To: ajit.khaparde@broadcom.com, somnath.kotur@broadcom.com Cc: dev@dpdk.org, Stephen Hemminger , Christopher Ertl Date: Tue, 3 Mar 2020 09:59:34 -0800 Message-Id: <20200303175938.14292-3-stephen@networkplumber.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200303175938.14292-1-stephen@networkplumber.org> References: <20200303175938.14292-1-stephen@networkplumber.org> MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH 2/6] net/bnxt: fix potential data race X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" The response from the firmware is accessed multiple times. This is a potential TOCTOU error. Reported-by: Christopher Ertl Signed-off-by: Stephen Hemminger Reported-by: Christopher Ertl Signed-off-by: Stephen Hemminger --- drivers/net/bnxt/bnxt_hwrm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index a9c9c7297cab..20e2f6a36713 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -3746,6 +3746,7 @@ int bnxt_hwrm_port_led_qcaps(struct bnxt *bp) { struct hwrm_port_led_qcaps_output *resp = bp->hwrm_cmd_resp_addr; struct hwrm_port_led_qcaps_input req = {0}; + uint8_t num_leds; int rc; if (BNXT_VF(bp)) @@ -3757,10 +3758,11 @@ int bnxt_hwrm_port_led_qcaps(struct bnxt *bp) HWRM_CHECK_RESULT(); - if (resp->num_leds > 0 && resp->num_leds < BNXT_MAX_LED) { + num_leds = resp->num_leds; + if (num_leds > 0 && num_leds < BNXT_MAX_LED) { unsigned int i; - bp->num_leds = resp->num_leds; + bp->num_leds = num_leds; memcpy(bp->leds, &resp->led0_id, sizeof(bp->leds[0]) * bp->num_leds); for (i = 0; i < bp->num_leds; i++) { From patchwork Tue Mar 3 17:59:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 66221 X-Patchwork-Delegate: ajit.khaparde@broadcom.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 68596A0571; Tue, 3 Mar 2020 19:00:11 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 779421C029; Tue, 3 Mar 2020 18:59:48 +0100 (CET) Received: from mail-pg1-f195.google.com (mail-pg1-f195.google.com [209.85.215.195]) by dpdk.org (Postfix) with ESMTP id 469771C01B for ; Tue, 3 Mar 2020 18:59:46 +0100 (CET) Received: by mail-pg1-f195.google.com with SMTP id m5so1905359pgg.0 for ; Tue, 03 Mar 2020 09:59:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=LjZDm1y9Bm3Y9T51ZbQPgdj+mQXmxtrPnw8e2sLhH+w=; b=fmGhWcq556D7HSfj15zwWxCJgSgF83+tpCVhYzcOw9xXpHqWtQaVC0jXPPdFDhHb7K ZAEh7AJym1AAV1/DWYYizPChNeqau+bRR5mjaFg1xcgGfuC5hcgsC8XEwXzYbte/xe3e 7T7Gn9KvljbNYctk1WEFHQ8sJbwAq3dfQQBFR2W60lpRAxkvQhqRGmxT1pFtjecG3CHG XK82gg3SuHkzj82Bi4sgpfA4gxyq8KotkMlnHZYmaHiA+cj1d9dgjGRyPuCnwccxPbrT l1AO4soGmqfFpI0GAV1RpHKdRJITmfHJ+fDJinUzdcUpIYU+Fbt2J7RneMNRo7w3O6E9 Nu8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=LjZDm1y9Bm3Y9T51ZbQPgdj+mQXmxtrPnw8e2sLhH+w=; b=o/5ORhmku64r/gPCct2DyWZmwQELk08ZOtUHoGX9+gx8dOpncfw5lgG/Iy/415Go4o KOJpwRCDYVjKNlhdBWIiapedLrf1FbNip6PGetHjrttAOsaU7Ap+VfKGrf28rndrUses 4wBtDKKu/IRrhNAFP2BCvlJRWas7KkX9ERdL0L7RuiMt8LlnxbuwymwdrylQODbfrxrV XEz6mZRM7+boqFR+Lt6NB27NgGFxtvZNQh+RF80GevFdaHd3OyMMyPHnyyS02Jr4mLfW ybfq7gytIuaWQl6hz7QKXCSJOJEvOA89LblOgdeS1S0XWao7RHCChTKteFepxCGb2Bnj ILwA== X-Gm-Message-State: ANhLgQ2Xt1rR3kIPZLgHyHmCxVZaqdgk4fyN0mtYfX+8FvDTzmLONXRi pwes2Tj279HmbkvIWW2oddPqaw== X-Google-Smtp-Source: ADFU+vur9sRjPRUABWf9oxQbPwe8YEst+U/h9Nv+CnQEV/lKoLyQxbEa6AqcSIg59mDO+hzjodLwrQ== X-Received: by 2002:a63:2a4e:: with SMTP id q75mr5171280pgq.358.1583258385478; Tue, 03 Mar 2020 09:59:45 -0800 (PST) Received: from hermes.corp.microsoft.com (204-195-22-127.wavecable.com. [204.195.22.127]) by smtp.gmail.com with ESMTPSA id w195sm22012158pfd.65.2020.03.03.09.59.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Mar 2020 09:59:44 -0800 (PST) From: Stephen Hemminger To: ajit.khaparde@broadcom.com, somnath.kotur@broadcom.com Cc: dev@dpdk.org, Stephen Hemminger , Christopher Ertl Date: Tue, 3 Mar 2020 09:59:35 -0800 Message-Id: <20200303175938.14292-4-stephen@networkplumber.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200303175938.14292-1-stephen@networkplumber.org> References: <20200303175938.14292-1-stephen@networkplumber.org> MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH 3/6] net/bnxt: avoid potential out of bounds read X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" If hardware returned a bogus number of vnic's from the query it could cause an out of bounds read into vnic table. Reported-by: Christopher Ertl Signed-off-by: Stephen Hemminger --- drivers/net/bnxt/bnxt_hwrm.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index 20e2f6a36713..ad8bdb1c2913 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -4029,6 +4029,12 @@ static int bnxt_hwrm_func_vf_vnic_query(struct bnxt *bp, uint16_t vf, HWRM_UNLOCK(); + if (rc > bp->pf.total_vnics) { + PMD_DRV_LOG(ERR, + "Vnic id %d is out of range\n", rc); + return -EINVAL; + } + return rc; } From patchwork Tue Mar 3 17:59:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 66222 X-Patchwork-Delegate: ajit.khaparde@broadcom.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 29D74A0571; Tue, 3 Mar 2020 19:00:19 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id AAABA1C037; Tue, 3 Mar 2020 18:59:49 +0100 (CET) Received: from mail-pf1-f193.google.com (mail-pf1-f193.google.com [209.85.210.193]) by dpdk.org (Postfix) with ESMTP id 94BF61C021 for ; Tue, 3 Mar 2020 18:59:47 +0100 (CET) Received: by mail-pf1-f193.google.com with SMTP id 2so1830099pfg.12 for ; Tue, 03 Mar 2020 09:59:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=IY9fGot27Lx8SYjW7fmgxyV883jhkPL/rosb+0Y3skg=; b=O/EwGFaYtOA/02Wl4df/N02xpptw+tOeHH9uxmeW1oF/m9PuoczLPG9MPMPgvBynt6 Y3YTFjmJV//QUvDJNhzsHrpwXvpS8jHiiS8YBYVArUkihO5GATr3S3eFaY3WtbHjqixH 4DQuPn2aAEo+YErHKhpU9+bWuPRSIlw0DjwAu3x5EGqxhcXxHMCBJX3IpoTTvvC4IkPO GFsQYtkFOHk2GWCAKtYtcoga+7XAHLBm+ilAvg89m/7kvjI6Cc3WbnGewT+uKfaRpUt+ Hb9uy0M71TVav+8d99ayph81dtm5De5Md46P2LqYZUTc+CAqfRb8lsCtggWygkLix65e NQKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=IY9fGot27Lx8SYjW7fmgxyV883jhkPL/rosb+0Y3skg=; b=XOn79gSa6y2Tc+JSVexG61Apw6dzt2EOUwVcuWfYS8s2s2zCFk1O6puY/BH6RF0DlI siU/ngjhg9K1C+O1At/VWESqwlEslTnGmpgCDJ565WqGdYyB3V85wTPm1U6qYuLLxg9S ALb0+E5fOO6gqMaSb34z9SxRqjAt5SbBZ1dlB1buv5UOJOSeJAqyj5xqhFuVqKecqNYZ W+EAfsvlIJUlryrtm5ENH5xMqhy5CBsrN2Dwm0t+YTXOE9FLUVkNpjRdxwzGdXp1taBG kDvC4H1R7UWwigVNWaxvutGzLF50yWGatenChSh6JTKBvd04LArvLYVvpRbdBDZ2WYKe bvAQ== X-Gm-Message-State: ANhLgQ2M6rQq/7S0Q2JR6ZIIp9tDHNk1tO6pvXqod59oFafo2v+rCmlk 4Iwm0r+QyaDIZ0eR+7LJVxpFQg== X-Google-Smtp-Source: ADFU+vuhLepTsyOlaFPGlxVWYk4ItjcTEbtFKbVulylJ0oD7wK1ABjg7QEhIiY594H2p6ckloc3RdQ== X-Received: by 2002:a62:7b4f:: with SMTP id w76mr5414983pfc.226.1583258386799; Tue, 03 Mar 2020 09:59:46 -0800 (PST) Received: from hermes.corp.microsoft.com (204-195-22-127.wavecable.com. [204.195.22.127]) by smtp.gmail.com with ESMTPSA id w195sm22012158pfd.65.2020.03.03.09.59.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Mar 2020 09:59:45 -0800 (PST) From: Stephen Hemminger To: ajit.khaparde@broadcom.com, somnath.kotur@broadcom.com Cc: dev@dpdk.org, Stephen Hemminger , Christopher Ertl Date: Tue, 3 Mar 2020 09:59:36 -0800 Message-Id: <20200303175938.14292-5-stephen@networkplumber.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200303175938.14292-1-stephen@networkplumber.org> References: <20200303175938.14292-1-stephen@networkplumber.org> MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH 4/6] net/bnxt: check for integer overflow in buffer sizing X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" If the hardware returns invalid values, the buffer size calculation could overflow. Check for this by using the GCC/Clang builtin that checks. Reported-by: Christopher Ertl Signed-off-by: Stephen Hemminger --- drivers/net/bnxt/bnxt_hwrm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index ad8bdb1c2913..6beb215d604f 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include "bnxt.h" @@ -3861,7 +3862,9 @@ int bnxt_get_nvram_directory(struct bnxt *bp, uint32_t len, uint8_t *data) len -= 2; memset(data, 0xff, len); - buflen = dir_entries * entry_length; + if (rte_mul_overflow(dir_entries, entry_length, &buflen)) + return -EINVAL; + buf = rte_malloc("nvm_dir", buflen, 0); if (buf == NULL) return -ENOMEM; From patchwork Tue Mar 3 17:59:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 66223 X-Patchwork-Delegate: ajit.khaparde@broadcom.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 2D18CA0571; Tue, 3 Mar 2020 19:00:30 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 647821C067; Tue, 3 Mar 2020 18:59:51 +0100 (CET) Received: from mail-pf1-f195.google.com (mail-pf1-f195.google.com [209.85.210.195]) by dpdk.org (Postfix) with ESMTP id 119DD1C02D for ; Tue, 3 Mar 2020 18:59:49 +0100 (CET) Received: by mail-pf1-f195.google.com with SMTP id y21so1858287pfp.1 for ; Tue, 03 Mar 2020 09:59:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=iiAVPSYe+1K5FDYKO4RyAgdhe04D6OI+9Bp5TS20wUs=; b=MB4wLR87I4s7Q+AchMhR/+6yfeD/NIFbfLYdLikxhOC64dS1psRQ9rQOGVlWmrTI8i +8s6FWIs/qvpr0C2ncFfnLxh/m024g0bWk4SaYV4benYitjuFNxjtkifY4pJLaiuE6hV NfxxDAY0aVcE1x2IuJHmzqcctofP192sVNq5JNoxxAe5ajtNDvJioOHrXOdZ6r+85iJ2 +IZC0ANQf0QZbTZRXMndr9d+jYKjTwd+ThgbclMR80KvHPX4wy6t2p2io1LSi1J9i/vv ggQsA2TIZiZGDV413QaeE0OwPp8WV/AADMmiydl++qp1f1LGWBKbDUI9llEFpcNKW6Ja sFmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=iiAVPSYe+1K5FDYKO4RyAgdhe04D6OI+9Bp5TS20wUs=; b=FYg+Mw6yGVYcgw5sQE19v4mjx9GGm617r1mHUrUKgU17jTK9eyp762GyK2Yfkgvl0r p21Tk6G0zx8uLfOyOz86D1qswJQo9HoQkKDLBpdaxAK8i1j/jld19aXuL+AKTjQV4w7p 1G7sW48M9yfLUrcyNNnt/dE3hVXf99s2j9BfsvnE0hxcpHSyehOPVe1vDFOlKvo3C6Bs HleaH4iUyslgeNd8vdRoBh7aJIOB5BPsSthYpGvvH8DzEpoVBj2YQy9mTYcVec5TVIrz Y3W2OLtMAPUmYAyDWHHO5ozArRr1DEe1zwsmZA1/ExIZ5TVZD6Dg0wVUFO4Ej5mxBZmv tkug== X-Gm-Message-State: ANhLgQ1V8t58lmehSoJjBcQ+Jx11VUCxbmEsfCfp9YATRoW0k/AJyoqQ R0apfh3fMsxQe53II8QyFzqjYg== X-Google-Smtp-Source: ADFU+vvBCee2vDXXe4+2g+PmijXOiVPP714K1dVrMuGpX5m6Oebp5Z8g501hSy7HIAw5pxgl7v41QA== X-Received: by 2002:aa7:85c8:: with SMTP id z8mr789579pfn.66.1583258388271; Tue, 03 Mar 2020 09:59:48 -0800 (PST) Received: from hermes.corp.microsoft.com (204-195-22-127.wavecable.com. [204.195.22.127]) by smtp.gmail.com with ESMTPSA id w195sm22012158pfd.65.2020.03.03.09.59.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Mar 2020 09:59:47 -0800 (PST) From: Stephen Hemminger To: ajit.khaparde@broadcom.com, somnath.kotur@broadcom.com Cc: dev@dpdk.org, Stephen Hemminger , Christopher Ertl Date: Tue, 3 Mar 2020 09:59:37 -0800 Message-Id: <20200303175938.14292-6-stephen@networkplumber.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200303175938.14292-1-stephen@networkplumber.org> References: <20200303175938.14292-1-stephen@networkplumber.org> MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH 5/6] net/bnxt: add integer underflow check X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" If a request to read a small value is passed to nvram reader it would underflow. Reported-by: Christopher Ertl Signed-off-by: Stephen Hemminger --- drivers/net/bnxt/bnxt_hwrm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index 6beb215d604f..d878320aa110 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -3859,6 +3859,9 @@ int bnxt_get_nvram_directory(struct bnxt *bp, uint32_t len, uint8_t *data) *data++ = dir_entries; *data++ = entry_length; + if (len <= 2) + return -EINVAL; + len -= 2; memset(data, 0xff, len); From patchwork Tue Mar 3 17:59:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Hemminger X-Patchwork-Id: 66224 X-Patchwork-Delegate: ajit.khaparde@broadcom.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7136BA0571; Tue, 3 Mar 2020 19:00:43 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 170C61C07D; Tue, 3 Mar 2020 18:59:53 +0100 (CET) Received: from mail-pf1-f195.google.com (mail-pf1-f195.google.com [209.85.210.195]) by dpdk.org (Postfix) with ESMTP id 56C1E1C044 for ; Tue, 3 Mar 2020 18:59:50 +0100 (CET) Received: by mail-pf1-f195.google.com with SMTP id j9so1840840pfa.8 for ; Tue, 03 Mar 2020 09:59:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=BR2FGVaXEaIy8R2p8pSAKFFtFJubdo86cCSrcBUH+ls=; b=JhW9NHMP/o7FD7qrGBBR634YSx/hQwYwn7PX6OsqTYdBvhN7/sJVc0X9JXEXRv6xxM 0haVzn9YKEhr6FSwI6n+xX8GHuZ4rxLcW3TYe/VVDsoKUhIykoMuMdvZed77zQu/v16M /6B8/pyuSgt8sZ9oUOVjFYPltT56ge9JgisA4d/cN9Lv4Osnan2FroGu6BYx0SPrdisB uinbO2woCofQKgN0hayC6NZwPANbpAM6PrDaaot1pom7Rvj+X85ZNcsUWVpDR9widgcm llPaG+H7KxVQNbEFHQSkB7VG+TuOgcP547VoOH7oecXSVnBEmomTX4FjnZM/vAP5XaJI ZYnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=BR2FGVaXEaIy8R2p8pSAKFFtFJubdo86cCSrcBUH+ls=; b=jd3zhsktlaypkZAnmNyrX0W3YshVxzMMFs4PIitpNKVa4Cgy0m7U1pRO9yIUFwPpIc C8t/SfF/NNfxdgbcnFyTK4X12NAgWIXqmrX9s2VaNqsDAQ8hwaBxftUpQdCNxURjLsJx zulku0Qw1l9yYNbeD635SqFrRmliFE6CcJ4DXGl4NtA9Z/3iRY2RN80MYF1V/Zd50Qil ip/KcTmc5zFlJqNBx+UxRyZOG3ZcrWPgk0Hs478zcFyNPHVPOpd2l1dELwgRmu+oWvHc oxINozWhIQkHbHyn2HdqKmgB1nZR17178FSy8jgoPYh1YKhqgKPUjGmu1l8039p+FYz3 RoBA== X-Gm-Message-State: ANhLgQ1kkvyRaz+b5lbWGIeq8LOeGfRjCkx5bjy/ZNn+Uivfpemi3Bd9 rg6whCNYyMGnQ9bztreE7tJ2yw== X-Google-Smtp-Source: ADFU+vuZpRyjQSXmLzoIdQxfQW4tQmsl29OmRYYj+Hph1tL6crSFYemfjeS3y+6pd4AQZdchD/jZtQ== X-Received: by 2002:a62:5bc7:: with SMTP id p190mr5257975pfb.16.1583258389548; Tue, 03 Mar 2020 09:59:49 -0800 (PST) Received: from hermes.corp.microsoft.com (204-195-22-127.wavecable.com. [204.195.22.127]) by smtp.gmail.com with ESMTPSA id w195sm22012158pfd.65.2020.03.03.09.59.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Mar 2020 09:59:48 -0800 (PST) From: Stephen Hemminger To: ajit.khaparde@broadcom.com, somnath.kotur@broadcom.com Cc: dev@dpdk.org, Stephen Hemminger , Christopher Ertl Date: Tue, 3 Mar 2020 09:59:38 -0800 Message-Id: <20200303175938.14292-7-stephen@networkplumber.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200303175938.14292-1-stephen@networkplumber.org> References: <20200303175938.14292-1-stephen@networkplumber.org> MIME-Version: 1.0 Subject: [dpdk-dev] [PATCH 6/6] net/bnxt: sanitize max_l2_ctx X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" If max_l2_ctx is very large, then adding the additional value could cause wraparound. Reported-by: Christopher Ertl Signed-off-by: Stephen Hemminger --- drivers/net/bnxt/bnxt_hwrm.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index d878320aa110..099e04fa550a 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -651,8 +651,15 @@ static int __bnxt_hwrm_func_qcaps(struct bnxt *bp) bp->first_vf_id = rte_le_to_cpu_16(resp->first_vf_id); bp->max_rx_em_flows = rte_le_to_cpu_16(resp->max_rx_em_flows); bp->max_l2_ctx = rte_le_to_cpu_16(resp->max_l2_ctxs); - if (!BNXT_CHIP_THOR(bp)) - bp->max_l2_ctx += bp->max_rx_em_flows; + if (!BNXT_CHIP_THOR(bp)) { + uint16_t max_l2_ctx; + + if (rte_add_overflow(bp->max_l2_ctx, bp->max_rx_em_flows, + &max_l2_ctx)) + return -EINVAL; + bp->max_l2_ctx = max_l2_ctx; + } + /* TODO: For now, do not support VMDq/RFS on VFs. */ if (BNXT_PF(bp)) { if (bp->pf.max_vfs)