diff mbox

[dpdk-dev,RFT] vmxnet3: coverity reported defect

Message ID 20180405083618.61509f5d@xeon-e3 (mailing list archive)
State Not Applicable, archived
Headers

Checks

Context Check Description
ci/checkpatch warning coding style issues
ci/Intel-compilation fail Compilation issues

Commit Message

Stephen Hemminger April 5, 2018, 3:36 p.m. UTC 
  I noticed Coverity defect in DPDK number 124563 was assigned to me.

It looks like vmxnet3 driver code doesn't handle case where host incorrectly
sends a frame with out setting SOP bit in first segment. This would lead to
rxq->start_seq being NULL.

Maybe something like this would fix it.  I don't have VMware (or time) to test.


PS: the email for the VMXNET3 maintainer  Shrikrishna Khare <skhare@vmware.com> bounces.

Comments

Ferruh Yigit April 5, 2018, 4:47 p.m. UTC | #1 
On 4/5/2018 4:36 PM, Stephen Hemminger wrote:
> I noticed Coverity defect in DPDK number 124563 was assigned to me.
> 
> It looks like vmxnet3 driver code doesn't handle case where host incorrectly
> sends a frame with out setting SOP bit in first segment. This would lead to
> rxq->start_seq being NULL.
> 
> Maybe something like this would fix it.  I don't have VMware (or time) to test.
> 
> diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
> index 57557492e0f5..3118d94add90 100644
> --- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
> +++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
> @@ -813,6 +813,13 @@ vmxnet3_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
>  
>  			RTE_ASSERT(rxd->btype == VMXNET3_RXD_BTYPE_BODY);
>  
> +			if (unlikely(start == NULL)) {
> +				PMD_RX_LOG(ERR, "Missing sop");
> +
> +				rte_pktmbuf_free_seg(rxm);
> +				goto rcd_done;
> +			}
> +
>  			start->pkt_len += rxm->data_len;
>  			start->nb_segs++;
>  
> 
> PS: the email for the VMXNET3 maintainer  Shrikrishna Khare <skhare@vmware.com> bounces.

Yong Wang send a patch [1] to take over vmxnet3 maintainership.

[1]
https://dpdk.org/dev/patchwork/patch/36795/
Neil Horman April 6, 2018, 11:18 a.m. UTC | #2 
On Thu, Apr 05, 2018 at 08:36:18AM -0700, Stephen Hemminger wrote:
> I noticed Coverity defect in DPDK number 124563 was assigned to me.
> 
> It looks like vmxnet3 driver code doesn't handle case where host incorrectly
> sends a frame with out setting SOP bit in first segment. This would lead to
> rxq->start_seq being NULL.
> 
> Maybe something like this would fix it.  I don't have VMware (or time) to test.
> 
> diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
> index 57557492e0f5..3118d94add90 100644
> --- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
> +++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
> @@ -813,6 +813,13 @@ vmxnet3_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
>  
>  			RTE_ASSERT(rxd->btype == VMXNET3_RXD_BTYPE_BODY);
>  
> +			if (unlikely(start == NULL)) {
> +				PMD_RX_LOG(ERR, "Missing sop");
> +
> +				rte_pktmbuf_free_seg(rxm);
> +				goto rcd_done;
> +			}
> +
>  			start->pkt_len += rxm->data_len;
>  			start->nb_segs++;
>  
This looks reasonable to me, though my vmware instance is down at the moment, so
I'm unable to test
> 
> PS: the email for the VMXNET3 maintainer  Shrikrishna Khare <skhare@vmware.com> bounces.
> 
I think it needs to be updated to point at pv-drivers@vmware.com, thats what
they use in the kernel these days

Neil
diff mbox

Patch

diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c b/drivers/net/vmxnet3/vmxnet3_rxtx.c
index 57557492e0f5..3118d94add90 100644
--- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
+++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
@@ -813,6 +813,13 @@  vmxnet3_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 
 			RTE_ASSERT(rxd->btype == VMXNET3_RXD_BTYPE_BODY);
 
+			if (unlikely(start == NULL)) {
+				PMD_RX_LOG(ERR, "Missing sop");
+
+				rte_pktmbuf_free_seg(rxm);
+				goto rcd_done;
+			}
+
 			start->pkt_len += rxm->data_len;
 			start->nb_segs++;