diff options
Diffstat (limited to 'debian/patches/nicvf-0008-net-thunderx-fix-stats-access-out-of-bounds.patch')
| -rw-r--r-- | debian/patches/nicvf-0008-net-thunderx-fix-stats-access-out-of-bounds.patch | 67 |
1 files changed, 67 insertions, 0 deletions
diff --git a/debian/patches/nicvf-0008-net-thunderx-fix-stats-access-out-of-bounds.patch b/debian/patches/nicvf-0008-net-thunderx-fix-stats-access-out-of-bounds.patch new file mode 100644 index 00000000..cd26df57 --- /dev/null +++ b/debian/patches/nicvf-0008-net-thunderx-fix-stats-access-out-of-bounds.patch @@ -0,0 +1,67 @@ +From 695cd416ce6c02d7a20108765573936998b2dbf0 Mon Sep 17 00:00:00 2001 +From: Marcin Wilk <marcin.wilk@caviumnetworks.com> +Date: Tue, 11 Apr 2017 14:35:13 +0200 +Subject: [PATCH] net/thunderx: fix stats access out of bounds + +Trying to assign more queues to stats struct break only from one loop +when the maximum size is reached. Outside loop iteration is continued. +This leads to access an array out of bounds. + +Fixes: 21e3fb0050b9 ("net/thunderx: add final bits for secondary queue support") +Cc: stable@dpdk.org + +Signed-off-by: Marcin Wilk <marcin.wilk@caviumnetworks.com> +Acked-by: Jerin Jacob <jerin.jacob@caviumnetworks.com> +--- + drivers/net/thunderx/nicvf_ethdev.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +Origin: http://dpdk.org/browse/dpdk/commit/?id=695cd416ce6c02d7a20108765573936998b2dbf0 +Original-Author: Marcin Wilk <marcin.wilk@caviumnetworks.com> +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/dpdk/+bug/1691659 +Author: Christian Ehrhardt <christian.ehrhardt@canonical.com> +Last-Update: 2017-05-18 + +diff --git a/drivers/net/thunderx/nicvf_ethdev.c b/drivers/net/thunderx/nicvf_ethdev.c +index b0b9c3b..36ff94f 100644 +--- a/drivers/net/thunderx/nicvf_ethdev.c ++++ b/drivers/net/thunderx/nicvf_ethdev.c +@@ -258,7 +258,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats) + + /* Reading per RX ring stats */ + for (qidx = rx_start; qidx <= rx_end; qidx++) { +- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS) ++ if (qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS) + break; + + nicvf_hw_get_rx_qstats(nic, &rx_qstats, qidx); +@@ -271,7 +271,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats) + + /* Reading per TX ring stats */ + for (qidx = tx_start; qidx <= tx_end; qidx++) { +- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS) ++ if (qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS) + break; + + nicvf_hw_get_tx_qstats(nic, &tx_qstats, qidx); +@@ -290,7 +290,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats) + + /* Reading per RX ring stats */ + for (qidx = rx_start; qidx <= rx_end; qidx++) { +- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS) ++ if (qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS) + break; + + nicvf_hw_get_rx_qstats(snic, &rx_qstats, +@@ -303,7 +303,7 @@ nicvf_dev_stats_get(struct rte_eth_dev *dev, struct rte_eth_stats *stats) + nicvf_tx_range(dev, snic, &tx_start, &tx_end); + /* Reading per TX ring stats */ + for (qidx = tx_start; qidx <= tx_end; qidx++) { +- if (qidx == RTE_ETHDEV_QUEUE_STAT_CNTRS) ++ if (qidx >= RTE_ETHDEV_QUEUE_STAT_CNTRS) + break; + + nicvf_hw_get_tx_qstats(snic, &tx_qstats, +-- +2.7.4 + |