On 05/07, alvinx.zh...@intel.com wrote: >From: Alvin Zhang <alvinx.zh...@intel.com> > >Fix some out-of-bounds memory issues, they may lead to wrong results >or affect application stability. > >Fixes: bd3fcf0d0fa1 (net/igc: support RSS) >Cc: sta...@dpdk.org
Please append the coverity number, you can refer to other fixes in the commit history. Thanks, Xiaolong > >Signed-off-by: Alvin Zhang <alvinx.zh...@intel.com> >--- > >V2: update git log > > drivers/net/igc/igc_ethdev.c | 12 ++++++++++-- > 1 file changed, 10 insertions(+), 2 deletions(-) > >diff --git a/drivers/net/igc/igc_ethdev.c b/drivers/net/igc/igc_ethdev.c >index 16d98c6..6ab3ee9 100644 >--- a/drivers/net/igc/igc_ethdev.c >+++ b/drivers/net/igc/igc_ethdev.c >@@ -2266,6 +2266,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > return -EINVAL; > } > >+ RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); >+ > /* set redirection table */ > for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { > union igc_rss_reta_reg reta, reg; >@@ -2278,7 +2280,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > IGC_RSS_RDT_REG_SIZE_MASK); > > /* if no need to update the register */ >- if (!mask) >+ if (!mask || >+ shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) > continue; > > /* check mask whether need to read the register value first */ >@@ -2289,6 +2292,7 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); > > /* update the register */ >+ RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); > for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { > if (mask & (1u << j)) > reta.bytes[j] = >@@ -2318,6 +2322,8 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev *dev, > return -EINVAL; > } > >+ RTE_BUILD_BUG_ON(ETH_RSS_RETA_SIZE_128 % IGC_RSS_RDT_REG_SIZE); >+ > /* read redirection table */ > for (i = 0; i < ETH_RSS_RETA_SIZE_128; i += IGC_RSS_RDT_REG_SIZE) { > union igc_rss_reta_reg reta; >@@ -2330,10 +2336,12 @@ static int eth_igc_vlan_tpid_set(struct rte_eth_dev >*dev, > IGC_RSS_RDT_REG_SIZE_MASK); > > /* if no need to read register */ >- if (!mask) >+ if (!mask || >+ shift > (RTE_RETA_GROUP_SIZE - IGC_RSS_RDT_REG_SIZE)) > continue; > > /* read register and get the queue index */ >+ RTE_BUILD_BUG_ON(sizeof(reta.bytes) != IGC_RSS_RDT_REG_SIZE); > reta.dword = IGC_READ_REG_LE_VALUE(hw, > IGC_RETA(i / IGC_RSS_RDT_REG_SIZE)); > for (j = 0; j < IGC_RSS_RDT_REG_SIZE; j++) { >-- >1.8.3.1 >