Patch Detail

HTTP 200 OK
Allow: GET, PUT, PATCH, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "id": 53085,
    "url": "https://patches.dpdk.org/api/patches/53085/?format=api",
    "web_url": "https://patches.dpdk.org/project/dpdk/patch/20190425164700.30948-1-herakliusz.lipiec@intel.com/",
    "project": {
        "id": 1,
        "url": "https://patches.dpdk.org/api/projects/1/?format=api",
        "name": "DPDK",
        "link_name": "dpdk",
        "list_id": "dev.dpdk.org",
        "list_email": "dev@dpdk.org",
        "web_url": "http://core.dpdk.org",
        "scm_url": "git://dpdk.org/dpdk",
        "webscm_url": "http://git.dpdk.org/dpdk",
        "list_archive_url": "https://inbox.dpdk.org/dev",
        "list_archive_url_format": "https://inbox.dpdk.org/dev/{}",
        "commit_url_format": ""
    },
    "msgid": "<20190425164700.30948-1-herakliusz.lipiec@intel.com>",
    "list_archive_url": "https://inbox.dpdk.org/dev/20190425164700.30948-1-herakliusz.lipiec@intel.com",
    "date": "2019-04-25T16:47:00",
    "name": "net/tap: fix potential buffer overrun",
    "commit_ref": null,
    "pull_url": null,
    "state": "superseded",
    "archived": true,
    "hash": "07b84a8fa3ecc60b583ab736ae5c3cba9390d072",
    "submitter": {
        "id": 742,
        "url": "https://patches.dpdk.org/api/people/742/?format=api",
        "name": "Herakliusz Lipiec",
        "email": "herakliusz.lipiec@intel.com"
    },
    "delegate": {
        "id": 319,
        "url": "https://patches.dpdk.org/api/users/319/?format=api",
        "username": "fyigit",
        "first_name": "Ferruh",
        "last_name": "Yigit",
        "email": "ferruh.yigit@amd.com"
    },
    "mbox": "https://patches.dpdk.org/project/dpdk/patch/20190425164700.30948-1-herakliusz.lipiec@intel.com/mbox/",
    "series": [
        {
            "id": 4470,
            "url": "https://patches.dpdk.org/api/series/4470/?format=api",
            "web_url": "https://patches.dpdk.org/project/dpdk/list/?series=4470",
            "date": "2019-04-25T16:47:00",
            "name": "net/tap: fix potential buffer overrun",
            "version": 1,
            "mbox": "https://patches.dpdk.org/series/4470/mbox/"
        }
    ],
    "comments": "https://patches.dpdk.org/api/patches/53085/comments/",
    "check": "fail",
    "checks": "https://patches.dpdk.org/api/patches/53085/checks/",
    "tags": {},
    "related": [],
    "headers": {
        "Return-Path": "<dev-bounces@dpdk.org>",
        "X-Original-To": "patchwork@dpdk.org",
        "Delivered-To": "patchwork@dpdk.org",
        "Received": [
            "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id 87A8A1B5C1;\n\tThu, 25 Apr 2019 18:46:08 +0200 (CEST)",
            "from mga11.intel.com (mga11.intel.com [192.55.52.93])\n\tby dpdk.org (Postfix) with ESMTP id 51AA51B5BA;\n\tThu, 25 Apr 2019 18:46:06 +0200 (CEST)",
            "from orsmga005.jf.intel.com ([10.7.209.41])\n\tby fmsmga102.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384;\n\t25 Apr 2019 09:46:04 -0700",
            "from silpixa00399499.ir.intel.com (HELO\n\tsilpixa00399499.ger.corp.intel.com) ([10.237.222.133])\n\tby orsmga005.jf.intel.com with ESMTP; 25 Apr 2019 09:46:03 -0700"
        ],
        "X-Amp-Result": "SKIPPED(no attachment in message)",
        "X-Amp-File-Uploaded": "False",
        "X-ExtLoop1": "1",
        "X-IronPort-AV": "E=Sophos;i=\"5.60,394,1549958400\"; d=\"scan'208\";a=\"318948216\"",
        "From": "Herakliusz Lipiec <herakliusz.lipiec@intel.com>",
        "To": "Keith Wiles <keith.wiles@intel.com>",
        "Cc": "dev@dpdk.org, Herakliusz Lipiec <herakliusz.lipiec@intel.com>,\n\trasland@mellanox.com, stable@dpdk.org",
        "Date": "Thu, 25 Apr 2019 17:47:00 +0100",
        "Message-Id": "<20190425164700.30948-1-herakliusz.lipiec@intel.com>",
        "X-Mailer": "git-send-email 2.17.2",
        "Subject": "[dpdk-dev] [PATCH] net/tap: fix potential buffer overrun",
        "X-BeenThere": "dev@dpdk.org",
        "X-Mailman-Version": "2.1.15",
        "Precedence": "list",
        "List-Id": "DPDK patches and discussions <dev.dpdk.org>",
        "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n\t<mailto:dev-request@dpdk.org?subject=unsubscribe>",
        "List-Archive": "<http://mails.dpdk.org/archives/dev/>",
        "List-Post": "<mailto:dev@dpdk.org>",
        "List-Help": "<mailto:dev-request@dpdk.org?subject=help>",
        "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n\t<mailto:dev-request@dpdk.org?subject=subscribe>",
        "Errors-To": "dev-bounces@dpdk.org",
        "Sender": "\"dev\" <dev-bounces@dpdk.org>"
    },
    "content": "When secondary to primary process synchronization occours\nthere is no check for number of fds which could cause buffer overrun.\n\nBugzilla ID: 252\nFixes: c9aa56edec8e (\"net/tap: access primary process queues from secondary\")\nCc: rasland@mellanox.com\nCc: stable@dpdk.org\n\nSigned-off-by: Herakliusz Lipiec <herakliusz.lipiec@intel.com>\n---\n drivers/net/tap/rte_eth_tap.c | 13 +++++++++++--\n 1 file changed, 11 insertions(+), 2 deletions(-)",
    "diff": "diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c\nindex e9fda8cf6..b985b1c84 100644\n--- a/drivers/net/tap/rte_eth_tap.c\n+++ b/drivers/net/tap/rte_eth_tap.c\n@@ -2111,6 +2111,10 @@ tap_mp_attach_queues(const char *port_name, struct rte_eth_dev *dev)\n \tTAP_LOG(DEBUG, \"Received IPC reply for %s\", reply_param->port_name);\n \n \t/* Attach the queues from received file descriptors */\n+\tif (reply_param->rxq_count + reply_param->txq_count != reply->num_fds){\n+\t\tTAP_LOG(ERR, \"Unexpected number of fds received\");\n+\t\treturn -1;\n+\t}\n \tdev->data->nb_rx_queues = reply_param->rxq_count;\n \tdev->data->nb_tx_queues = reply_param->txq_count;\n \tfd_iterator = 0;\n@@ -2151,12 +2155,16 @@ tap_mp_sync_queues(const struct rte_mp_msg *request, const void *peer)\n \t/* Fill file descriptors for all queues */\n \treply.num_fds = 0;\n \treply_param->rxq_count = 0;\n+\tif (dev->data->nb_rx_queues + dev->data->nb_tx_queues >\n+\t\t\tRTE_MP_MAX_FD_NUM){\n+\t\tTAP_LOG(ERR, \"Number of rx/tx queues exceeds max number of fds\");\n+\t\treturn -1;\n+\t}\n \tfor (queue = 0; queue < dev->data->nb_rx_queues; queue++) {\n \t\treply.fds[reply.num_fds++] = process_private->rxq_fds[queue];\n \t\treply_param->rxq_count++;\n \t}\n \tRTE_ASSERT(reply_param->rxq_count == dev->data->nb_rx_queues);\n-\tRTE_ASSERT(reply_param->txq_count == dev->data->nb_tx_queues);\n \tRTE_ASSERT(reply.num_fds <= RTE_MP_MAX_FD_NUM);\n \n \treply_param->txq_count = 0;\n@@ -2164,7 +2172,8 @@ tap_mp_sync_queues(const struct rte_mp_msg *request, const void *peer)\n \t\treply.fds[reply.num_fds++] = process_private->txq_fds[queue];\n \t\treply_param->txq_count++;\n \t}\n-\n+\tRTE_ASSERT(reply_param->txq_count == dev->data->nb_tx_queues);\n+\tRTE_ASSERT(reply.num_fds <= RTE_MP_MAX_FD_NUM);\n \t/* Send reply */\n \tstrlcpy(reply.name, request->name, sizeof(reply.name));\n \tstrlcpy(reply_param->port_name, request_param->port_name,\n",
    "prefixes": []
}