From patchwork Fri Nov 17 10:12:04 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ferruh Yigit X-Patchwork-Id: 134445 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id CF98243351; Fri, 17 Nov 2023 11:12:17 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 5FF9740648; Fri, 17 Nov 2023 11:12:17 +0100 (CET) Received: from NAM04-BN8-obe.outbound.protection.outlook.com (mail-bn8nam04on2089.outbound.protection.outlook.com [40.107.100.89]) by mails.dpdk.org (Postfix) with ESMTP id B2B3B40273; Fri, 17 Nov 2023 11:12:15 +0100 (CET) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jOzBF356uAoD1rLyHT66l7cBmhw8hwHqqiWxF0k9oq2oDVrZLiVcC1SxfEqHxb+d/eQJAr8OTZs1GYwfvq3q/9Y5blFEAmkScfoSzrym+AJzSWGGETXMY7chnXOfNqYP4513xLa2H2jzOi/h6WOTGBOAi8mZkbDuqa7+j3erNvpmE1aF3Slkc21MzkNwPm7uDLxERygfXYo3bLHBD62jagtGjLFc0TgoHhTA8Jgzm1q335ne8lC9mr1Vts1/z0SCzsv0aPdQPKAJbcgt+ZfMlieucvu48JV9t23Co1bj8OM1p/Fh/MeUzl5TC635Pxu+H+sG5kdhyItfxoXevLC7qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=9W2bTsc7fE5WA3huhepDqlsJP+zNkikgKssQfvkU8zg=; b=ZjupQH2bjvRI0L0H/hWcDwEC2l3dYD5SKau61SWLdAW1IV5knnDk2rUo4W5J9cGv9xpYDee934xHLOrgKZasXsBJLc+nGq5rnzgF9mg4yBOpaLk4QXWR/icbj3rCyoyxnYZwXkPUGu3N5jlUzX9KRPYwL8lVDlByuL1mjc28qNr5mn2VTeNIq8vQb4hKyVO6ypYiB7y2UhoQ4fhwIgyGv7IrG01qn8rQQFjO3sYw0Bp5MR2aRadbB0hK1MDZA12DZrXnsFvvT3UMnxGJ4syvu4uWLViG9Cye/79FnrAPAPTl+Do6B35Vfz7D2AOPkRdWrZ4tA5kQ3cdpvQ1iPjGuTw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=trustnetic.com smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=9W2bTsc7fE5WA3huhepDqlsJP+zNkikgKssQfvkU8zg=; b=NEASzIa3138lmDl3CyXUE6pA9QZmEI41u4pWnUY3472x5KY+0hKbTF3+aflibVdVtrLIkilRnNLwxCMPJDlzeIAEj61ANt3CrFz8a4UENwNH2oGdDFodnFE/a+f/oaBsI0Fl9qtvgAn2WgLTjicmYcCVxl6EFjTAC74YMrPIUn0= Received: from SA9PR13CA0151.namprd13.prod.outlook.com (2603:10b6:806:28::6) by PH8PR12MB6770.namprd12.prod.outlook.com (2603:10b6:510:1c5::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7002.23; Fri, 17 Nov 2023 10:12:13 +0000 Received: from SA2PEPF0000150A.namprd04.prod.outlook.com (2603:10b6:806:28:cafe::d) by SA9PR13CA0151.outlook.office365.com (2603:10b6:806:28::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7025.8 via Frontend Transport; Fri, 17 Nov 2023 10:12:13 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by SA2PEPF0000150A.mail.protection.outlook.com (10.167.242.42) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.7002.20 via Frontend Transport; Fri, 17 Nov 2023 10:12:12 +0000 Received: from telcodpdk.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.32; Fri, 17 Nov 2023 04:12:11 -0600 From: Ferruh Yigit To: Jiawen Wu , Jian Wang , Ferruh Yigit CC: , , Luca Boccassi Subject: [PATCH v2] net/txgbe: fix out of bound access Date: Fri, 17 Nov 2023 10:12:04 +0000 Message-ID: <20231117101204.2389690-1-ferruh.yigit@amd.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20231116140718.4026676-1-ferruh.yigit@amd.com> References: <20231116140718.4026676-1-ferruh.yigit@amd.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SA2PEPF0000150A:EE_|PH8PR12MB6770:EE_ X-MS-Office365-Filtering-Correlation-Id: ffb497b2-9943-44dc-ece7-08dbe755aae7 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: 89Bu+Lyt9cLX/SZEF4jKmPj7mzUoSIdHWZLGyJBwG3LTxYZgG5RQgUsgVHpCNd/VsFvd7HL194CNlzDsCo55vUynX4PQ/B0mn9mspuWnHB74uab7EWV1B4sdK3o6TSgT6o8lTTAA3EWkxpY/Tm0TxeyqH15sRuOlj4fMdmWQlEKqO1YRXRiUkhLiur4oJinlu8UHL4i7HYc3kt1Fm4nSXqOmyK10zQFKjy0W/SisCBMrz6jQJHIk82GgmPKl9cGiaV6wcMF0PC58/lfwCLBTfbgi+Fpl7ucdzWC4MF+X8pH+Vd1nBodxfAmWuzyowCAQJl/uVPwwNeklhsfr3XYbRDtTAfgBSxcSmyQAj2jn3T3hp01E5OdvC5vfLw3nks4wYBU1Px1I/st6ccnjEQh30jX6Sjq5oDqgU9+0cZFQTncfukHRKYhdks2RzbNdXj6SzaxwjVTEVDQkGTEjezV9Mt3U9nbOeoiqIhokUqhE44G3KqQHPocv/UiBOV2aDYfgiIUQlWtCK29k6N35L9Y4qeAM0BBHHvHDDmh3Bk5MUzC/BM2S4JZRNr3nSzqz7umooV2hLBrFm6NTONQ+1ZLLdizL5d9ZTPhZ2xL3rGGhtDroIJ84lSb9Bm//IW8Es/83bXKpsvdKeA16jsQVuq3YKwuie2KG/MAskSzlEGthXOhyqO/LjNOn2CEj4oQY+WqUp3zQUC5TJuqAZyIT0kYcCmMgd00d9Qtlmjs3tJsPA03buDMsWyma388v5lubLtImqc53Ptne47ypnX0kgUm78Q== X-Forefront-Antispam-Report: CIP:165.204.84.17; CTRY:US; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:SATLEXMB04.amd.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230031)(4636009)(396003)(376002)(346002)(39860400002)(136003)(230922051799003)(451199024)(186009)(82310400011)(64100799003)(1800799009)(40470700004)(36840700001)(46966006)(40460700003)(6666004)(45080400002)(86362001)(7696005)(81166007)(82740400003)(356005)(966005)(36756003)(2906002)(478600001)(426003)(336012)(47076005)(36860700001)(83380400001)(2616005)(16526019)(26005)(41300700001)(1076003)(5660300002)(4326008)(316002)(54906003)(44832011)(8936002)(8676002)(40480700001)(110136005)(70206006)(70586007)(36900700001); DIR:OUT; SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Nov 2023 10:12:12.7994 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: ffb497b2-9943-44dc-ece7-08dbe755aae7 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: SA2PEPF0000150A.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR12MB6770 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Reported by SuSe CI [1] by GCC [2], possibly false positive. Error: In function 'txgbe_host_interface_command', inlined from 'txgbe_host_interface_command' at ../drivers/net/txgbe/base/txgbe_mng.c:104:1, inlined from 'txgbe_hic_reset' at ../drivers/net/txgbe/base/txgbe_mng.c:345:9: ../drivers/net/txgbe/base/txgbe_mng.c:145:36: error: array subscript 2 is outside array bounds ofr 'struct txgbe_hic_reset[1]' [-Werror=array-bounds=] 145 | buffer[bi] = rd32a(hw, TXGBE_MNGMBX, bi); ../drivers/net/txgbe/base/txgbe_mng.c: In function 'txgbe_hic_reset': ../drivers/net/txgbe/base/txgbe_mng.c:331:32: note: at offset 8 into object 'reset_cmd' of size 8 331 | struct txgbe_hic_reset reset_cmd; | ^~~~~~~~~ Access to buffer done based on command code, the case complained by FW_RESET_CMD has short buffer but this code path only taken with command 0x30, so this shouldn't be a problem. Command 0x30 no more used, removing this exception check that cause build error. [1] https://build.opensuse.org/public/build/home:bluca:dpdk/openSUSE_Factory_ARM/armv7l/dpdk-20.11/_log [2] gcc 13.2.1 "cc (SUSE Linux) 13.2.1 20230912 Fixes: 35c90ecccfd4 ("net/txgbe: add EEPROM functions") Cc: stable@dpdk.org Reported-by: Luca Boccassi Signed-off-by: Ferruh Yigit Reviewed-by: Jiawen Wu --- Cc: jiawenwu@trustnetic.com Cc: jianwang@trustnetic.com v2: * Removed exception check for command 0x30 --- drivers/net/txgbe/base/txgbe_mng.c | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/drivers/net/txgbe/base/txgbe_mng.c b/drivers/net/txgbe/base/txgbe_mng.c index df7145094f84..029a0a1fe143 100644 --- a/drivers/net/txgbe/base/txgbe_mng.c +++ b/drivers/net/txgbe/base/txgbe_mng.c @@ -141,21 +141,7 @@ txgbe_host_interface_command(struct txgbe_hw *hw, u32 *buffer, for (bi = 0; bi < dword_len; bi++) buffer[bi] = rd32a(hw, TXGBE_MNGMBX, bi); - /* - * If there is any thing in data position pull it in - * Read Flash command requires reading buffer length from - * two byes instead of one byte - */ - if (resp->cmd == 0x30) { - for (; bi < dword_len + 2; bi++) - buffer[bi] = rd32a(hw, TXGBE_MNGMBX, bi); - - buf_len = (((u16)(resp->cmd_or_resp.ret_status) << 3) - & 0xF00) | resp->buf_len; - hdr_size += (2 << 2); - } else { - buf_len = resp->buf_len; - } + buf_len = resp->buf_len; if (!buf_len) goto rel_out;