From patchwork Wed Jul 24 12:06:34 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pavan Nikhilesh Bhagavatula X-Patchwork-Id: 57016 X-Patchwork-Delegate: jerinj@marvell.com Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id E725A1C1CF; Wed, 24 Jul 2019 14:06:41 +0200 (CEST) Received: from mx0b-0016f401.pphosted.com (mx0a-0016f401.pphosted.com [67.231.148.174]) by dpdk.org (Postfix) with ESMTP id 975141C1CE for ; Wed, 24 Jul 2019 14:06:39 +0200 (CEST) Received: from pps.filterd (m0045849.ppops.net [127.0.0.1]) by mx0a-0016f401.pphosted.com (8.16.0.42/8.16.0.42) with SMTP id x6OC5Aod019922 for ; Wed, 24 Jul 2019 05:06:38 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=marvell.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding : content-type; s=pfpt0818; bh=wl5HnKCgAF3Ago1JfT7pJyn1t+lTlbrkVvqU0O+C6aU=; b=EwiFhsXdlkf0N6A8+AYULKpSImpD3CmlSq6GYz+dFGEiUJn0h4pVG68lioUH7qI714sE oBv1jG5vNFMMia4wtEwZkwzJEVIq+4XE5JxBzzKSt8ctWkQmwX+yTBVjk7w86TZ4vaJb QerIoxWdWaAe9Pk53u8TypvL4pL5sfHq7F+p9FZ8QD5xSKosZUHNINHumC2y1KUeVyIZ 27NULnRJuu/9YWPpNBXWU7zdz+2FoGBn08OYmkw7vMIGPSd+wMolafQ1LzY6AdCkzV+v jSWDFpgncFJY0Nvzu8GZckuCJAEUL84yOYOt+vUQJQRojIlC/vPJ0EDArfz8YAvFSDH5 Ow== Received: from sc-exch02.marvell.com ([199.233.58.182]) by mx0a-0016f401.pphosted.com with ESMTP id 2tx61rbwu3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Wed, 24 Jul 2019 05:06:38 -0700 Received: from SC-EXCH03.marvell.com (10.93.176.83) by SC-EXCH02.marvell.com (10.93.176.82) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Wed, 24 Jul 2019 05:06:37 -0700 Received: from maili.marvell.com (10.93.176.43) by SC-EXCH03.marvell.com (10.93.176.83) with Microsoft SMTP Server id 15.0.1367.3 via Frontend Transport; Wed, 24 Jul 2019 05:06:37 -0700 Received: from BG-LT7430.marvell.com (bg-lt7430.marvell.com [10.28.17.32]) by maili.marvell.com (Postfix) with ESMTP id 9867A3F703F; Wed, 24 Jul 2019 05:06:36 -0700 (PDT) From: To: , Pavan Nikhilesh CC: Date: Wed, 24 Jul 2019 17:36:34 +0530 Message-ID: <20190724120634.804-1-pbhagavatula@marvell.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:5.22.84,1.0.8 definitions=2019-07-24_05:2019-07-24,2019-07-24 signatures=0 Subject: [dpdk-dev] [PATCH v2] event/octeontx2: fix NULL dereference X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" From: Pavan Nikhilesh Fix NULL dereference after rte_realloc and add extra NULL checks. Fix few memory leak with kvargs. Coverity issue: 345023, 345022, 345009, 345011, 345026, 344997, 344990 Fixes: ffa4ec0b6063 ("event/octeontx2: allow adapters to resize inflight buffers") Signed-off-by: Pavan Nikhilesh --- drivers/event/octeontx2/otx2_evdev.c | 16 ++++++++++++++-- drivers/event/octeontx2/otx2_evdev_adptr.c | 8 ++++++++ drivers/event/octeontx2/otx2_tim_evdev.c | 15 +++++++++++++-- 3 files changed, 35 insertions(+), 4 deletions(-) diff --git a/drivers/event/octeontx2/otx2_evdev.c b/drivers/event/octeontx2/otx2_evdev.c index e6379e3b4..160ac94ee 100644 --- a/drivers/event/octeontx2/otx2_evdev.c +++ b/drivers/event/octeontx2/otx2_evdev.c @@ -1404,7 +1404,12 @@ sso_xae_reconfigure(struct rte_eventdev *event_dev) prev_xaq_pool = dev->xaq_pool; dev->xaq_pool = NULL; - sso_xaq_allocate(dev); + rc = sso_xaq_allocate(dev); + if (rc < 0) { + otx2_err("Failed to alloc xaq pool %d", rc); + rte_mempool_free(prev_xaq_pool); + return rc; + } rc = sso_ggrp_alloc_xaq(dev); if (rc < 0) { otx2_err("Failed to alloc xaq to ggrp %d", rc); @@ -1517,6 +1522,7 @@ parse_queue_param(char *value, void *opaque) uint8_t *val = (uint8_t *)&queue_qos; struct otx2_sso_evdev *dev = opaque; char *tok = strtok(value, "-"); + struct otx2_sso_qos *old_ptr; if (!strlen(value)) return; @@ -1533,9 +1539,15 @@ parse_queue_param(char *value, void *opaque) } dev->qos_queue_cnt++; + old_ptr = dev->qos_parse_data; dev->qos_parse_data = rte_realloc(dev->qos_parse_data, sizeof(struct otx2_sso_qos) * dev->qos_queue_cnt, 0); + if (dev->qos_parse_data == NULL) { + dev->qos_parse_data = old_ptr; + dev->qos_queue_cnt--; + return; + } dev->qos_parse_data[dev->qos_queue_cnt - 1] = queue_qos; } @@ -1553,7 +1565,7 @@ parse_qos_list(const char *value, void *opaque) else if (*s == ']') end = s; - if (start < end && *start) { + if (start && start < end) { *end = 0; parse_queue_param(start + 1, opaque); s = end; diff --git a/drivers/event/octeontx2/otx2_evdev_adptr.c b/drivers/event/octeontx2/otx2_evdev_adptr.c index 0c4f18ec2..b6e9f59d1 100644 --- a/drivers/event/octeontx2/otx2_evdev_adptr.c +++ b/drivers/event/octeontx2/otx2_evdev_adptr.c @@ -203,6 +203,7 @@ sso_updt_xae_cnt(struct otx2_sso_evdev *dev, void *data, uint32_t event_type) { struct otx2_eth_rxq *rxq = data; int i, match = false; + uint64_t *old_ptr; for (i = 0; i < dev->rx_adptr_pool_cnt; i++) { if ((uint64_t)rxq->pool == dev->rx_adptr_pools[i]) @@ -211,10 +212,17 @@ sso_updt_xae_cnt(struct otx2_sso_evdev *dev, void *data, uint32_t event_type) if (!match) { dev->rx_adptr_pool_cnt++; + old_ptr = dev->rx_adptr_pools; dev->rx_adptr_pools = rte_realloc(dev->rx_adptr_pools, sizeof(uint64_t) * dev->rx_adptr_pool_cnt , 0); + if (dev->rx_adptr_pools == NULL) { + dev->adptr_xae_cnt += rxq->pool->size; + dev->rx_adptr_pools = old_ptr; + dev->rx_adptr_pool_cnt--; + return; + } dev->rx_adptr_pools[dev->rx_adptr_pool_cnt - 1] = (uint64_t)rxq->pool; diff --git a/drivers/event/octeontx2/otx2_tim_evdev.c b/drivers/event/octeontx2/otx2_tim_evdev.c index ecc7563ce..e8316a6c7 100644 --- a/drivers/event/octeontx2/otx2_tim_evdev.c +++ b/drivers/event/octeontx2/otx2_tim_evdev.c @@ -549,6 +549,7 @@ tim_parse_ring_param(char *value, void *opaque) struct otx2_tim_evdev *dev = opaque; struct otx2_tim_ctl ring_ctl = {0}; char *tok = strtok(value, "-"); + struct otx2_tim_ctl *old_ptr; uint16_t *val; val = (uint16_t *)&ring_ctl; @@ -569,8 +570,16 @@ tim_parse_ring_param(char *value, void *opaque) } dev->ring_ctl_cnt++; + old_ptr = dev->ring_ctl_data; dev->ring_ctl_data = rte_realloc(dev->ring_ctl_data, - sizeof(struct otx2_tim_ctl), 0); + sizeof(struct otx2_tim_ctl) * + dev->ring_ctl_cnt, 0); + if (dev->ring_ctl_data == NULL) { + dev->ring_ctl_data = old_ptr; + dev->ring_ctl_cnt--; + return; + } + dev->ring_ctl_data[dev->ring_ctl_cnt - 1] = ring_ctl; } @@ -588,7 +597,7 @@ tim_parse_ring_ctl_list(const char *value, void *opaque) else if (*s == ']') end = s; - if (start < end && *start) { + if (start && start < end) { *end = 0; tim_parse_ring_param(start + 1, opaque); start = end; @@ -635,6 +644,8 @@ tim_parse_devargs(struct rte_devargs *devargs, struct otx2_tim_evdev *dev) &dev->min_ring_cnt); rte_kvargs_process(kvlist, OTX2_TIM_RING_CTL, &tim_parse_kvargs_dict, &dev); + + rte_kvargs_free(kvlist); } void