[dpdk-dev] [PATCH v3] net/i40e: fix out of bounds read issue

[Jeff Guo]

On 5/14/2020 9:16 AM, Di, ChenxuX wrote:
> Hi,
>
>
>
>> -----Original Message-----
>> From: Guo, Jia
>> Sent: Wednesday, May 13, 2020 2:51 PM
>> To: Di, ChenxuX <chenxux.di at intel.com>; dev at dpdk.org
>> Cc: Xing, Beilei <beilei.xing at intel.com>
>> Subject: Re: [PATCH v3] net/i40e: fix out of bounds read issue
>>
>> hi, chenxu
>>
>> On 5/13/2020 10:26 AM, Chenxu Di wrote:
>>> This patch fixes (out-of-bounds read) coverity issue.
>>>
>>> Coverity issue: 357699
>>> Coverity issue: 357694
>>> Fixes: feaae285b342 ("net/i40e: support hash configuration in RSS
>>> flow")
>>>
>>> Signed-off-by: Chenxu Di <chenxux.di at intel.com>
>>> ---
>>>    drivers/net/i40e/i40e_ethdev.c | 6 ++++++
>>>    1 file changed, 6 insertions(+)
>>>
>>> diff --git a/drivers/net/i40e/i40e_ethdev.c
>>> b/drivers/net/i40e/i40e_ethdev.c index 749d85f54..c2d5c6835 100644
>>> --- a/drivers/net/i40e/i40e_ethdev.c
>>> +++ b/drivers/net/i40e/i40e_ethdev.c
>>> @@ -13179,6 +13179,9 @@ i40e_rss_config_hash_function(struct i40e_pf *pf,
>>>    				break;
>>>    		}
>>>
>>> +		if (i == UINT64_BIT)
>>> +			return 0;
>>> +
>>
>> Should this function need to return none zero value and show error info out, or
>> said should considerate "out of bound" as a configure failed.
>>
> It will just find the flow type and do the things. If not find the flow type, it just do nothing and return.


i40e_rss_config_hash_function is return int value right, should it 
always return 0? Should the case of not finding be considerate as 
none-success config?


>>>    		for (j = I40E_FILTER_PCTYPE_INVALID + 1;
>>>    		     j < I40E_FILTER_PCTYPE_MAX; j++) {
>>>    			if (pf->adapter->pctypes_tbl[i] & (1ULL << j))
>>> @@ -13311,6 +13314,9 @@ i40e_rss_clear_hash_function(struct i40e_pf *pf,
>>>    				break;
>>>    		}
>>>
>>> +		if (i == UINT64_BIT)
>>> +			return 0;
>>> +
>>>    		for (j = I40E_FILTER_PCTYPE_INVALID + 1;
>>>    		     j < I40E_FILTER_PCTYPE_MAX; j++) {
>>>    			if (pf->adapter->pctypes_tbl[i] & (1ULL << j))