Skip to content

Commit 3f6a0b6

Browse files
committed
app: ood: fix stack corruption
dao_flow_query_count structure has addition 8 bytes for SW (ACL/EM) backed flow query stats. Passing a field of size struct rte_flow_query_count shall result in stack courruption due to additional 8 bytes returned to query arg. Signed-off-by: Harman Kalra <hkalra@marvell.com> Change-Id: I4495fd5ef9c126f6db3a7988d7ee9f5eb2195996 Reviewed-on: https://sj1git1.cavium.com/c/IP/SW/dataplane/dpu-offload/+/140873 Tested-by: sa_ip-toolkits-Jenkins <sa_ip-toolkits-jenkins@marvell.com>
1 parent 694aed7 commit 3f6a0b6

File tree

1 file changed

+6
-3
lines changed

1 file changed

+6
-3
lines changed

app/ovs-offload/control/ood_flow_ctrl.c

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -882,19 +882,19 @@ ood_flow_query(uint16_t repr_qid, struct dao_flow *flow, uint8_t reset,
882882
ood_msg_ack_data_t *adata)
883883
{
884884
/* Currently only query count supported by cnxk driver */
885-
struct rte_flow_query_count query;
885+
struct dao_flow_query_count query;
886886
representor_mapping_t *rep_map;
887887
size_t sz;
888888
int rc = 0;
889889

890-
sz = sizeof(struct rte_flow_query_count);
891890
/* Get the flow ctrl structure */
892891
rep_map = ood_representor_mapping_get(repr_qid);
893892
if (!rep_map)
894893
DAO_ERR_GOTO(-EINVAL, fail,
895894
"Failed to get valid flow ctrl handle for repr queue %d", repr_qid);
896895

897896
/* Query the flow */
897+
memset(&query, 0, sizeof(query));
898898
query.reset = reset;
899899
memset(err, 0, sizeof(*err));
900900
rc = dao_flow_query(rep_map->host_port, flow, action, &query, err);
@@ -904,8 +904,11 @@ ood_flow_query(uint16_t repr_qid, struct dao_flow *flow, uint8_t reset,
904904
rep_map->host_port);
905905
}
906906

907-
dao_dbg("Flow query: hits %ld hits_set %d", query.hits, query.hits_set);
907+
dao_dbg("Flow query: hits %ld hits_set %d bytes %ld bytes_set %d", query.hits,
908+
query.hits_set, query.bytes, query.bytes_set);
908909

910+
/* Copy only required for rte_flow_query_count */
911+
sz = sizeof(struct rte_flow_query_count);
909912
adata->u.data = rte_zmalloc("Ack Data", sz, 0);
910913
rte_memcpy(adata->u.data, &query, sz);
911914
adata->size = sz;

0 commit comments

Comments
 (0)