patch 'common/cnxk: fix null pointer dereferences' has been queued to stable release 21.11.1
Kevin Traynor
ktraynor at redhat.com
Mon Feb 21 16:34:35 CET 2022
Hi,
FYI, your patch has been queued to stable release 21.11.1
Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 02/26/22. So please
shout if anyone has objections.
Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.
Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable
This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/38f3a00894a1c056bf2b4e0e13395884c94fc65d
Thanks.
Kevin
---
>From 38f3a00894a1c056bf2b4e0e13395884c94fc65d Mon Sep 17 00:00:00 2001
From: Nithin Dabilpuram <ndabilpuram at marvell.com>
Date: Fri, 21 Jan 2022 17:34:20 +0530
Subject: [PATCH] common/cnxk: fix null pointer dereferences
[ upstream commit da718c1919bd49faa83ded38b0549500c7e77f91 ]
Fix null pointer dereference issues reported by
klockwork(static analysis tool).
Fixes: c045d2e5cbbc ("common/cnxk: add CPT configuration")
Fixes: 585bb3e538f9 ("common/cnxk: add VF support to base device class")
Fixes: 665ff1ccc2c4 ("common/cnxk: add base device class")
Fixes: da57d4589a6f ("common/cnxk: support NIX flow control")
Fixes: 218d022e1f3f ("common/cnxk: support NIX stats")
Fixes: 4efa6e82fe43 ("common/cnxk: support NIX extended stats")
Fixes: 0885429c3028 ("common/cnxk: add NIX TM hierarchy enable/disable")
Signed-off-by: Gowrishankar Muthukrishnan <gmuthukrishn at marvell.com>
Signed-off-by: Nithin Dabilpuram <ndabilpuram at marvell.com>
Acked-by: Jerin Jacob <jerinj at marvell.com>
---
drivers/common/cnxk/roc_cpt.c | 3 ++
drivers/common/cnxk/roc_dev.c | 19 +++++++++
drivers/common/cnxk/roc_nix_debug.c | 6 +++
drivers/common/cnxk/roc_nix_fc.c | 12 ++++++
drivers/common/cnxk/roc_nix_queue.c | 61 +++++++++++++++++++++++++++--
drivers/common/cnxk/roc_nix_stats.c | 18 +++++++++
drivers/common/cnxk/roc_nix_tm.c | 6 +++
7 files changed, 121 insertions(+), 4 deletions(-)
diff --git a/drivers/common/cnxk/roc_cpt.c b/drivers/common/cnxk/roc_cpt.c
index 8f8e6d3821..84cc5f05d7 100644
--- a/drivers/common/cnxk/roc_cpt.c
+++ b/drivers/common/cnxk/roc_cpt.c
@@ -386,4 +386,7 @@ cpt_lfs_alloc(struct dev *dev, uint8_t eng_grpmsk, uint8_t blkaddr,
req = mbox_alloc_msg_cpt_lf_alloc(mbox);
+ if (!req)
+ return -ENOSPC;
+
req->nix_pf_func = 0;
if (inl_dev_sso && nix_inl_dev_pffunc_get())
diff --git a/drivers/common/cnxk/roc_dev.c b/drivers/common/cnxk/roc_dev.c
index 926a916e44..0ac50cab59 100644
--- a/drivers/common/cnxk/roc_dev.c
+++ b/drivers/common/cnxk/roc_dev.c
@@ -153,4 +153,9 @@ af_pf_wait_msg(struct dev *dev, uint16_t vf, int num_msg)
size = PLT_ALIGN(size, MBOX_MSG_ALIGN);
rsp = mbox_alloc_msg(&dev->mbox_vfpf, vf, size);
+ if (!rsp) {
+ plt_err("Failed to reserve VF%d message", vf);
+ continue;
+ }
+
mbox_rsp_init(msg->id, rsp);
@@ -237,4 +242,10 @@ vf_pf_process_msgs(struct dev *dev, uint16_t vf)
rsp = (struct ready_msg_rsp *)mbox_alloc_msg(
mbox, vf, sizeof(*rsp));
+ if (!rsp) {
+ plt_err("Failed to alloc VF%d READY message",
+ vf);
+ continue;
+ }
+
mbox_rsp_init(msg->id, rsp);
@@ -989,4 +1000,7 @@ dev_setup_shared_lmt_region(struct mbox *mbox, bool valid_iova, uint64_t iova)
req = mbox_alloc_msg_lmtst_tbl_setup(mbox);
+ if (!req)
+ return -ENOSPC;
+
/* This pcifunc is defined with primary pcifunc whose LMT address
* will be shared. If call contains valid IOVA, following pcifunc
@@ -1062,4 +1076,9 @@ dev_lmt_setup(struct dev *dev)
if (!dev->disable_shared_lmt) {
idev = idev_get_cfg();
+ if (!idev) {
+ errno = EFAULT;
+ goto free;
+ }
+
if (!__atomic_load_n(&idev->lmt_pf_func, __ATOMIC_ACQUIRE)) {
idev->lmt_base_addr = dev->lmt_base;
diff --git a/drivers/common/cnxk/roc_nix_debug.c b/drivers/common/cnxk/roc_nix_debug.c
index 266935a6c5..7dc54f3845 100644
--- a/drivers/common/cnxk/roc_nix_debug.c
+++ b/drivers/common/cnxk/roc_nix_debug.c
@@ -324,4 +324,7 @@ nix_q_ctx_get(struct dev *dev, uint8_t ctype, uint16_t qid, __io void **ctx_p)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = qid;
aq->ctype = ctype;
@@ -342,4 +345,7 @@ nix_q_ctx_get(struct dev *dev, uint8_t ctype, uint16_t qid, __io void **ctx_p)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = qid;
aq->ctype = ctype;
diff --git a/drivers/common/cnxk/roc_nix_fc.c b/drivers/common/cnxk/roc_nix_fc.c
index ca29cd2bf9..d31137188e 100644
--- a/drivers/common/cnxk/roc_nix_fc.c
+++ b/drivers/common/cnxk/roc_nix_fc.c
@@ -114,4 +114,7 @@ nix_fc_cq_config_get(struct roc_nix *roc_nix, struct roc_nix_fc_cfg *fc_cfg)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = fc_cfg->cq_cfg.rq;
aq->ctype = NIX_AQ_CTYPE_CQ;
@@ -121,4 +124,7 @@ nix_fc_cq_config_get(struct roc_nix *roc_nix, struct roc_nix_fc_cfg *fc_cfg)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = fc_cfg->cq_cfg.rq;
aq->ctype = NIX_AQ_CTYPE_CQ;
@@ -148,4 +154,7 @@ nix_fc_cq_config_set(struct roc_nix *roc_nix, struct roc_nix_fc_cfg *fc_cfg)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = fc_cfg->cq_cfg.rq;
aq->ctype = NIX_AQ_CTYPE_CQ;
@@ -165,4 +174,7 @@ nix_fc_cq_config_set(struct roc_nix *roc_nix, struct roc_nix_fc_cfg *fc_cfg)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = fc_cfg->cq_cfg.rq;
aq->ctype = NIX_AQ_CTYPE_CQ;
diff --git a/drivers/common/cnxk/roc_nix_queue.c b/drivers/common/cnxk/roc_nix_queue.c
index e631e10e04..e79a2d63e2 100644
--- a/drivers/common/cnxk/roc_nix_queue.c
+++ b/drivers/common/cnxk/roc_nix_queue.c
@@ -55,4 +55,7 @@ nix_rq_ena_dis(struct dev *dev, struct roc_nix_rq *rq, bool enable)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = rq->qid;
aq->ctype = NIX_AQ_CTYPE_RQ;
@@ -65,4 +68,7 @@ nix_rq_ena_dis(struct dev *dev, struct roc_nix_rq *rq, bool enable)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = rq->qid;
aq->ctype = NIX_AQ_CTYPE_RQ;
@@ -96,4 +102,7 @@ nix_rq_cn9k_cfg(struct dev *dev, struct roc_nix_rq *rq, uint16_t qints,
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = rq->qid;
aq->ctype = NIX_AQ_CTYPE_RQ;
@@ -211,4 +220,7 @@ nix_rq_cfg(struct dev *dev, struct roc_nix_rq *rq, uint16_t qints, bool cfg,
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = rq->qid;
aq->ctype = NIX_AQ_CTYPE_RQ;
@@ -479,4 +491,7 @@ roc_nix_cq_init(struct roc_nix *roc_nix, struct roc_nix_cq *cq)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = cq->qid;
aq->ctype = NIX_AQ_CTYPE_CQ;
@@ -487,4 +502,7 @@ roc_nix_cq_init(struct roc_nix *roc_nix, struct roc_nix_cq *cq)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = cq->qid;
aq->ctype = NIX_AQ_CTYPE_CQ;
@@ -563,4 +581,7 @@ roc_nix_cq_fini(struct roc_nix_cq *cq)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = cq->qid;
aq->ctype = NIX_AQ_CTYPE_CQ;
@@ -574,4 +595,7 @@ roc_nix_cq_fini(struct roc_nix_cq *cq)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = cq->qid;
aq->ctype = NIX_AQ_CTYPE_CQ;
@@ -665,5 +689,5 @@ fail:
}
-static void
+static int
sq_cn9k_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
uint16_t smq)
@@ -673,4 +697,7 @@ sq_cn9k_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = sq->qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -701,4 +728,5 @@ sq_cn9k_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
*/
aq->sq.qint_idx = 0;
+ return 0;
}
@@ -714,4 +742,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = sq->qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -727,4 +758,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
/* Disable sq */
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = sq->qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -738,4 +772,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
/* Read SQ and free sqb's */
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = sq->qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -769,5 +806,5 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
}
-static void
+static int
sq_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
uint16_t smq)
@@ -777,4 +814,7 @@ sq_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = sq->qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -804,4 +844,5 @@ sq_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
*/
aq->sq.qint_idx = 0;
+ return 0;
}
@@ -817,4 +858,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = sq->qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -830,4 +874,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
/* Disable sq */
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = sq->qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -841,4 +888,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
/* Read SQ and free sqb's */
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = sq->qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -911,7 +961,10 @@ roc_nix_sq_init(struct roc_nix *roc_nix, struct roc_nix_sq *sq)
/* Init SQ context */
if (roc_model_is_cn9k())
- sq_cn9k_init(nix, sq, rr_quantum, smq);
+ rc = sq_cn9k_init(nix, sq, rr_quantum, smq);
else
- sq_init(nix, sq, rr_quantum, smq);
+ rc = sq_init(nix, sq, rr_quantum, smq);
+
+ if (rc)
+ goto nomem;
rc = mbox_process(mbox);
diff --git a/drivers/common/cnxk/roc_nix_stats.c b/drivers/common/cnxk/roc_nix_stats.c
index c50c8fa629..756111fb1c 100644
--- a/drivers/common/cnxk/roc_nix_stats.c
+++ b/drivers/common/cnxk/roc_nix_stats.c
@@ -125,4 +125,7 @@ nix_stat_rx_queue_reset(struct nix *nix, uint16_t qid)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = qid;
aq->ctype = NIX_AQ_CTYPE_RQ;
@@ -144,4 +147,7 @@ nix_stat_rx_queue_reset(struct nix *nix, uint16_t qid)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = qid;
aq->ctype = NIX_AQ_CTYPE_RQ;
@@ -175,4 +181,7 @@ nix_stat_tx_queue_reset(struct nix *nix, uint16_t qid)
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -191,4 +200,7 @@ nix_stat_tx_queue_reset(struct nix *nix, uint16_t qid)
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -296,4 +308,7 @@ roc_nix_xstats_get(struct roc_nix *roc_nix, struct roc_nix_xstat *xstats,
if (roc_model_is_cn9k()) {
req = mbox_alloc_msg_cgx_stats(mbox);
+ if (!req)
+ return -ENOSPC;
+
req->hdr.pcifunc = roc_nix_get_pf_func(roc_nix);
@@ -317,4 +332,7 @@ roc_nix_xstats_get(struct roc_nix *roc_nix, struct roc_nix_xstat *xstats,
} else {
req = mbox_alloc_msg_rpm_stats(mbox);
+ if (!req)
+ return -ENOSPC;
+
req->hdr.pcifunc = roc_nix_get_pf_func(roc_nix);
diff --git a/drivers/common/cnxk/roc_nix_tm.c b/drivers/common/cnxk/roc_nix_tm.c
index b3d8ebd3c2..21533b5cae 100644
--- a/drivers/common/cnxk/roc_nix_tm.c
+++ b/drivers/common/cnxk/roc_nix_tm.c
@@ -767,4 +767,7 @@ nix_tm_sq_sched_conf(struct nix *nix, struct nix_tm_node *node,
aq = mbox_alloc_msg_nix_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
@@ -782,4 +785,7 @@ nix_tm_sq_sched_conf(struct nix *nix, struct nix_tm_node *node,
aq = mbox_alloc_msg_nix_cn10k_aq_enq(mbox);
+ if (!aq)
+ return -ENOSPC;
+
aq->qidx = qid;
aq->ctype = NIX_AQ_CTYPE_SQ;
--
2.34.1
---
Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- - 2022-02-21 15:22:46.493345834 +0000
+++ 0086-common-cnxk-fix-null-pointer-dereferences.patch 2022-02-21 15:22:44.178704321 +0000
@@ -1 +1 @@
-From da718c1919bd49faa83ded38b0549500c7e77f91 Mon Sep 17 00:00:00 2001
+From 38f3a00894a1c056bf2b4e0e13395884c94fc65d Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit da718c1919bd49faa83ded38b0549500c7e77f91 ]
+
@@ -16 +17,0 @@
-Cc: stable at dpdk.org
@@ -32 +33 @@
-index 1bc7a29ef9..3f3d28196b 100644
+index 8f8e6d3821..84cc5f05d7 100644
@@ -87 +88 @@
-index 5886650d6e..583e2e43c8 100644
+index 266935a6c5..7dc54f3845 100644
@@ -143 +144 @@
-index e8b42ed6be..a283d96a01 100644
+index e631e10e04..e79a2d63e2 100644
@@ -210 +211 @@
-@@ -675,5 +699,5 @@ fail:
+@@ -665,5 +689,5 @@ fail:
@@ -217 +218 @@
-@@ -683,4 +707,7 @@ sq_cn9k_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
+@@ -673,4 +697,7 @@ sq_cn9k_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
@@ -225 +226 @@
-@@ -711,4 +738,5 @@ sq_cn9k_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
+@@ -701,4 +728,5 @@ sq_cn9k_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
@@ -231 +232 @@
-@@ -724,4 +752,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
+@@ -714,4 +742,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
@@ -239 +240 @@
-@@ -737,4 +768,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
+@@ -727,4 +758,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
@@ -247 +248 @@
-@@ -748,4 +782,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
+@@ -738,4 +772,7 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
@@ -255 +256 @@
-@@ -779,5 +816,5 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
+@@ -769,5 +806,5 @@ sq_cn9k_fini(struct nix *nix, struct roc_nix_sq *sq)
@@ -262 +263 @@
-@@ -787,4 +824,7 @@ sq_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
+@@ -777,4 +814,7 @@ sq_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
@@ -270 +271 @@
-@@ -814,4 +854,5 @@ sq_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
+@@ -804,4 +844,5 @@ sq_init(struct nix *nix, struct roc_nix_sq *sq, uint32_t rr_quantum,
@@ -276 +277 @@
-@@ -827,4 +868,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
+@@ -817,4 +858,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
@@ -284 +285 @@
-@@ -840,4 +884,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
+@@ -830,4 +874,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
@@ -292 +293 @@
-@@ -851,4 +898,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
+@@ -841,4 +888,7 @@ sq_fini(struct nix *nix, struct roc_nix_sq *sq)
@@ -300 +301 @@
-@@ -921,7 +971,10 @@ roc_nix_sq_init(struct roc_nix *roc_nix, struct roc_nix_sq *sq)
+@@ -911,7 +961,10 @@ roc_nix_sq_init(struct roc_nix *roc_nix, struct roc_nix_sq *sq)
@@ -366 +367 @@
-index fe9e83fe1e..3b38cc087b 100644
+index b3d8ebd3c2..21533b5cae 100644
More information about the stable
mailing list