d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

power: fix sanity checks for guest channel read

Browse Source 
In function power_guest_channel_read_msg, 'lcore_id' is used before
validity check, which may cause buffer 'global_fds' accessed by index
'lcore_id' overflow.

This patch moves the validity check of 'lcore_id' before the 'lcore_id'
being used for the first time.

Fixes: 9dc843eb27 ("power: extend guest channel API for reading")
Cc: stable@dpdk.org

Signed-off-by: Hongbo Zheng <zhenghongbo3@huawei.com>
Signed-off-by: Min Hu (Connor) <humin29@huawei.com>
Reviewed-by: Reshma Pattan <reshma.pattan@intel.com>
Acked-by: David Hunt <david.hunt@intel.com>
This commit is contained in:
Hongbo Zheng 2021-05-12 10:19:19 +08:00 committed by Thomas Monjalon
parent 428eaeb822
commit 1fe00fd358
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
lib/power/guest_channel.c
View File

@ -166,6 +166,17 @@ int power_guest_channel_read_msg(void *pkt,
if (pkt_len == 0 || pkt == NULL)
return -1;
if (lcore_id >= RTE_MAX_LCORE) {
RTE_LOG(ERR, GUEST_CHANNEL, "Channel(%u) is out of range 0...%d\n",
lcore_id, RTE_MAX_LCORE-1);
return -1;
}
if (global_fds[lcore_id] < 0) {
RTE_LOG(ERR, GUEST_CHANNEL, "Channel is not connected\n");
return -1;
}
fds.fd = global_fds[lcore_id];
fds.events = POLLIN;
@ -179,17 +190,6 @@ int power_guest_channel_read_msg(void *pkt,
return -1;
}
if (lcore_id >= RTE_MAX_LCORE) {
RTE_LOG(ERR, GUEST_CHANNEL, "Channel(%u) is out of range 0...%d\n",
lcore_id, RTE_MAX_LCORE-1);
return -1;
}
if (global_fds[lcore_id] < 0) {
RTE_LOG(ERR, GUEST_CHANNEL, "Channel is not connected\n");
return -1;
}
while (pkt_len > 0) {
ret = read(global_fds[lcore_id],
pkt, pkt_len);