From: Joseph Wong <[email protected]>
In ulp_bit_alloc_list_alloc(), the loop condition could allow the
index to reach bsize_64 before the bounds check ran (the do-while
body reads blist->bdata[idx++] before the loop condition tests
idx <= bsize_64), causing an out-of-bounds read one element past
the array. Refactor the loop to check the bound before indexing.
Fixes: 0001cc58d362 ("net/bnxt: support generic hash table")
Cc: [email protected]
Signed-off-by: Joseph Wong <[email protected]>
Signed-off-by: Manish Kurup <[email protected]>
---
.mailmap | 1 +
drivers/net/bnxt/tf_ulp/ulp_gen_hash.c | 17 ++++++++---------
2 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/.mailmap b/.mailmap
index 2e348c3bce..e013a7d6ba 100644
--- a/.mailmap
+++ b/.mailmap
@@ -813,6 +813,7 @@ Jonathan Tsai <[email protected]>
Joongi Kim <[email protected]>
Jörg Thalheim <[email protected]>
Joseph Richard <[email protected]>
+Joseph Wong <[email protected]>
Josh Soref <[email protected]>
Joshua Hay <[email protected]>
Joshua Washington <[email protected]>
diff --git a/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
b/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
index 74cdd5c1da..d94b59286f 100644
--- a/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
+++ b/drivers/net/bnxt/tf_ulp/ulp_gen_hash.c
@@ -21,16 +21,15 @@ int32_t ulp_bit_alloc_list_alloc(struct bit_alloc_list
*blist,
uint32_t bsize_64 = blist->bsize / ULP_64B_IN_BYTES;
/* Iterate all numbers that have all 1's */
- do {
- bentry = blist->bdata[idx++];
- } while (bentry == -1UL && idx <= bsize_64);
-
- if (idx <= bsize_64) {
- if (bentry)
+ while (idx < bsize_64) {
+ bentry = blist->bdata[idx];
+ if (bentry != -1UL) {
jdx = rte_clz64(~bentry);
- *index = ((idx - 1) * ULP_INDEX_BITMAP_SIZE) + jdx;
- ULP_INDEX_BITMAP_SET(blist->bdata[(idx - 1)], jdx);
- return 0;
+ *index = (idx * ULP_INDEX_BITMAP_SIZE) + jdx;
+ ULP_INDEX_BITMAP_SET(blist->bdata[idx], jdx);
+ return 0;
+ }
+ idx++;
}
jdx = (uint32_t)(bsize_64 * ULP_INDEX_BITMAP_SIZE);
BNXT_DRV_DBG(ERR, "bit allocator is full reached max:%d\n", jdx);
--
2.31.1
