Skip to content

Commit fdb29fa

Browse files
committed
Add: Compile-time guards for st41 TX payload geometry
Coverity CID 561696 reports an OVERRUN in build_packet, taking sizeof(hdr->rtp) as the bound; the real extent is sizeof(st41_fmd_hdr) + max_pkt_len into a larger mbuf element, so it is a false positive. Pin the two premises that verdict rests on: max_pkt_len stays a multiple of 4 (the payload write rounds up to a whole word), and st41_fmd_hdr stays layout-identical to mt_udp_hdr + st41_rtp_hdr (the chain payload mbuf is sized from one, max_pkt_len derives from the other). Signed-off-by: Wilczynski, Andrzej <andrzej.wilczynski@intel.com>
1 parent 079aaf7 commit fdb29fa

1 file changed

Lines changed: 9 additions & 0 deletions

File tree

lib/src/st2110/st_tx_fastmetadata_session.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1459,6 +1459,7 @@ static int tx_fastmetadata_session_attach(struct mtl_main_impl* impl,
14591459
s->tx_mono_pool = mt_user_tx_mono_pool(impl);
14601460
/* manually disable chain or any port can't support chain */
14611461
s->tx_no_chain = mt_user_tx_no_chain(impl) || !tx_fastmetadata_session_has_chain_buf(s);
1462+
/* keep a multiple of 4, see the build asserts in tx_fastmetadata_sessions_mgr_init */
14621463
s->max_pkt_len = ST_PKT_MAX_ETHER_BYTES - sizeof(struct st41_fmd_hdr);
14631464

14641465
s->st41_frames_cnt = ops->framebuff_cnt;
@@ -1681,6 +1682,14 @@ static int tx_fastmetadata_sessions_mgr_init(
16811682
int i;
16821683

16831684
RTE_BUILD_BUG_ON(sizeof(struct st41_fmd_hdr) != 58);
1685+
/* The payload write rounds up to a whole 4-byte word, but build_packet's room check
1686+
* tests the unrounded length and build_rtp_packet has no room check at all, so
1687+
* nothing at runtime bounds the round-up. max_pkt_len derives from st41_fmd_hdr,
1688+
* while the chain payload mbuf is sized from the separately declared mt_udp_hdr: a
1689+
* max_pkt_len off a 4-byte multiple or a divergence there exceeds the declared room. */
1690+
RTE_BUILD_BUG_ON((ST_PKT_MAX_ETHER_BYTES - sizeof(struct st41_fmd_hdr)) % 4 != 0);
1691+
RTE_BUILD_BUG_ON(sizeof(struct mt_udp_hdr) + sizeof(struct st41_rtp_hdr) !=
1692+
sizeof(struct st41_fmd_hdr));
16841693

16851694
mgr->parent = impl;
16861695
mgr->idx = idx;

0 commit comments

Comments
 (0)