[dpdk-stable] patch 'net/ring: check internal arguments' has been queued to stable release 19.11.6

[luca.boccassi at gmail.com]

Hi,

FYI, your patch has been queued to stable release 19.11.6

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 10/30/20. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Thanks.

Luca Boccassi

---
>From f0a2c7875173de240a75e5f6fedbb5d9068b4d40 Mon Sep 17 00:00:00 2001
From: Kevin Laatz <kevin.laatz at intel.com>
Date: Tue, 13 Oct 2020 14:07:04 +0100
Subject: [PATCH] net/ring: check internal arguments

[ upstream commit e37bbe212d48a7375a6239478a114829d05692b5 ]

Add a check for the return value of the sscanf call in
parse_internal_args(), returning an error if we don't get the expected
result.

Coverity issue: 362049
Fixes: 96cb19521147 ("net/ring: use EAL APIs in PMD specific API")

Signed-off-by: Kevin Laatz <kevin.laatz at intel.com>
Reviewed-by: Ferruh Yigit <ferruh.yigit at intel.com>
---
 drivers/net/ring/rte_eth_ring.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ring/rte_eth_ring.c b/drivers/net/ring/rte_eth_ring.c
index f0fafa0c0d..f35f54e78d 100644
--- a/drivers/net/ring/rte_eth_ring.c
+++ b/drivers/net/ring/rte_eth_ring.c
@@ -16,6 +16,7 @@
 #define ETH_RING_ACTION_CREATE		"CREATE"
 #define ETH_RING_ACTION_ATTACH		"ATTACH"
 #define ETH_RING_INTERNAL_ARG		"internal"
+#define ETH_RING_INTERNAL_ARG_MAX_LEN	19 /* "0x..16chars..\0" */
 
 static const char *valid_arguments[] = {
 	ETH_RING_NUMA_NODE_ACTION_ARG,
@@ -539,8 +540,21 @@ parse_internal_args(const char *key __rte_unused, const char *value,
 {
 	struct ring_internal_args **internal_args = data;
 	void *args;
+	int ret, n;
 
-	sscanf(value, "%p", &args);
+	/* make sure 'value' is valid pointer length */
+	if (strnlen(value, ETH_RING_INTERNAL_ARG_MAX_LEN) >=
+			ETH_RING_INTERNAL_ARG_MAX_LEN) {
+		PMD_LOG(ERR, "Error parsing internal args, argument is too long");
+		return -1;
+	}
+
+	ret = sscanf(value, "%p%n", &args, &n);
+	if (ret == 0 || (size_t)n != strlen(value)) {
+		PMD_LOG(ERR, "Error parsing internal args");
+
+		return -1;
+	}
 
 	*internal_args = args;
 
-- 
2.20.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2020-10-28 10:35:17.210498506 +0000
+++ 0177-net-ring-check-internal-arguments.patch	2020-10-28 10:35:11.784834145 +0000
@@ -1,15 +1,16 @@
-From e37bbe212d48a7375a6239478a114829d05692b5 Mon Sep 17 00:00:00 2001
+From f0a2c7875173de240a75e5f6fedbb5d9068b4d40 Mon Sep 17 00:00:00 2001
 From: Kevin Laatz <kevin.laatz at intel.com>
 Date: Tue, 13 Oct 2020 14:07:04 +0100
 Subject: [PATCH] net/ring: check internal arguments
 
+[ upstream commit e37bbe212d48a7375a6239478a114829d05692b5 ]
+
 Add a check for the return value of the sscanf call in
 parse_internal_args(), returning an error if we don't get the expected
 result.
 
 Coverity issue: 362049
 Fixes: 96cb19521147 ("net/ring: use EAL APIs in PMD specific API")
-Cc: stable at dpdk.org
 
 Signed-off-by: Kevin Laatz <kevin.laatz at intel.com>
 Reviewed-by: Ferruh Yigit <ferruh.yigit at intel.com>
@@ -18,7 +19,7 @@
  1 file changed, 15 insertions(+), 1 deletion(-)
 
 diff --git a/drivers/net/ring/rte_eth_ring.c b/drivers/net/ring/rte_eth_ring.c
-index 83c5502123..22c0802688 100644
+index f0fafa0c0d..f35f54e78d 100644
 --- a/drivers/net/ring/rte_eth_ring.c
 +++ b/drivers/net/ring/rte_eth_ring.c
 @@ -16,6 +16,7 @@
@@ -29,7 +30,7 @@
  
  static const char *valid_arguments[] = {
  	ETH_RING_NUMA_NODE_ACTION_ARG,
-@@ -571,8 +572,21 @@ parse_internal_args(const char *key __rte_unused, const char *value,
+@@ -539,8 +540,21 @@ parse_internal_args(const char *key __rte_unused, const char *value,
  {
  	struct ring_internal_args **internal_args = data;
  	void *args;