Skip to content

Commit

Permalink
app: ood: fix stack corruption
Browse files Browse the repository at this point in the history
dao_flow_query_count structure has addition 8 bytes for SW (ACL/EM)
backed flow query stats. Passing a field of size struct
rte_flow_query_count shall result in stack courruption due to
additional 8 bytes returned to query arg.

Signed-off-by: Harman Kalra <hkalra@marvell.com>
Change-Id: I4495fd5ef9c126f6db3a7988d7ee9f5eb2195996
Reviewed-on: https://sj1git1.cavium.com/c/IP/SW/dataplane/dpu-offload/+/140873
Tested-by: sa_ip-toolkits-Jenkins <sa_ip-toolkits-jenkins@marvell.com>
  • Loading branch information
harman-kalra committed Dec 5, 2024
1 parent 694aed7 commit 3f6a0b6
Showing 1 changed file with 6 additions and 3 deletions.
9 changes: 6 additions & 3 deletions app/ovs-offload/control/ood_flow_ctrl.c
Original file line number Diff line number Diff line change
Expand Up @@ -882,19 +882,19 @@ ood_flow_query(uint16_t repr_qid, struct dao_flow *flow, uint8_t reset,
ood_msg_ack_data_t *adata)
{
/* Currently only query count supported by cnxk driver */
struct rte_flow_query_count query;
struct dao_flow_query_count query;
representor_mapping_t *rep_map;
size_t sz;
int rc = 0;

sz = sizeof(struct rte_flow_query_count);
/* Get the flow ctrl structure */
rep_map = ood_representor_mapping_get(repr_qid);
if (!rep_map)
DAO_ERR_GOTO(-EINVAL, fail,
"Failed to get valid flow ctrl handle for repr queue %d", repr_qid);

/* Query the flow */
memset(&query, 0, sizeof(query));
query.reset = reset;
memset(err, 0, sizeof(*err));
rc = dao_flow_query(rep_map->host_port, flow, action, &query, err);
Expand All @@ -904,8 +904,11 @@ ood_flow_query(uint16_t repr_qid, struct dao_flow *flow, uint8_t reset,
rep_map->host_port);
}

dao_dbg("Flow query: hits %ld hits_set %d", query.hits, query.hits_set);
dao_dbg("Flow query: hits %ld hits_set %d bytes %ld bytes_set %d", query.hits,
query.hits_set, query.bytes, query.bytes_set);

/* Copy only required for rte_flow_query_count */
sz = sizeof(struct rte_flow_query_count);
adata->u.data = rte_zmalloc("Ack Data", sz, 0);
rte_memcpy(adata->u.data, &query, sz);
adata->size = sz;
Expand Down

0 comments on commit 3f6a0b6

Please sign in to comment.