From 54d612f78a417090bc0449658426d9180b84b2e9 Mon Sep 17 00:00:00 2001 From: Jijie Shao Date: Wed, 14 Aug 2024 16:16:57 +0800 Subject: [PATCH 10/27] hikptool: nic: Fix the Code review comments in NIC modules Fix issue of Out-of-bounds access may occur. Signed-off-by: Jijie Shao --- net/nic/nic_dfx/hikp_nic_dfx.c | 20 +++++++++++++++++++- net/nic/nic_mac/hikp_nic_port.c | 7 +++++++ 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/net/nic/nic_dfx/hikp_nic_dfx.c b/net/nic/nic_dfx/hikp_nic_dfx.c index 4095229..2cc4367 100644 --- a/net/nic/nic_dfx/hikp_nic_dfx.c +++ b/net/nic/nic_dfx/hikp_nic_dfx.c @@ -21,6 +21,9 @@ #include "hikp_net_lib.h" #include "hikp_nic_dfx.h" +#define dfx_get_max_reg_bffer_size(rsp_head) \ + (uint32_t)((rsp_head)->total_blk_num * MAX_DFX_DATA_NUM * sizeof(uint32_t)) + struct nic_dfx_param g_dfx_param = { 0 }; static const struct dfx_module_cmd g_dfx_module_parse[] = { @@ -138,7 +141,7 @@ static int hikp_nic_get_first_blk_dfx(struct nic_dfx_rsp_head_t *rsp_head, uint3 rsp_head->total_type_num = 0; goto err_out; } - *max_dfx_size = (uint32_t)(rsp_head->total_blk_num * MAX_DFX_DATA_NUM * sizeof(uint32_t)); + *max_dfx_size = dfx_get_max_reg_bffer_size(rsp_head); *reg_data = (uint32_t *)calloc(1, *max_dfx_size); if (*reg_data == NULL) { HIKP_ERROR_PRINT("malloc log memory 0x%x failed.\n", *max_dfx_size); @@ -284,8 +287,23 @@ static void hikp_nic_dfx_print(const struct nic_dfx_rsp_head_t *rsp_head, uint32 struct nic_dfx_type_head *type_head; uint8_t last_type_id = 0; uint32_t *ptr = reg_data; + uint32_t max_size; + uint32_t num_u32; uint8_t i; + max_size = dfx_get_max_reg_bffer_size(rsp_head); + for (i = 0; i < rsp_head->total_type_num; i++) { + type_head = (struct nic_dfx_type_head *)ptr; + num_u32 = type_head->reg_num * WORD_NUM_PER_REG + 1; /* including type_head */ + if (max_size < num_u32 * sizeof(uint32_t)) { + HIKP_ERROR_PRINT("register real size exceeds the max size\n"); + return; + } + ptr += num_u32; + max_size -= num_u32 * sizeof(uint32_t); + } + + ptr = reg_data; printf("****************** module %s reg dump start ********************\n", g_dfx_module_parse[g_dfx_param.module_idx].module_name); for (i = 0; i < rsp_head->total_type_num; i++) { diff --git a/net/nic/nic_mac/hikp_nic_port.c b/net/nic/nic_mac/hikp_nic_port.c index 725ef95..f818001 100644 --- a/net/nic/nic_mac/hikp_nic_port.c +++ b/net/nic/nic_mac/hikp_nic_port.c @@ -498,9 +498,16 @@ static void mac_cmd_print_cdr_dfx(struct mac_cmd_cdr_dfx *cdr_dfx, struct mac_po static void mac_cmd_disp_cdr_info(struct mac_cmd_cdr_dfx *cdr_dfx) { + uint8_t cdr_max_num = HIKP_ARRAY_SIZE(cdr_dfx->wire_cdr.dfx); + if (!cdr_dfx->cdr_num) return; + if (cdr_dfx->cdr_num > cdr_max_num) { + printf("the cdr_num(%u) exceeds %u\n", cdr_dfx->cdr_num, cdr_max_num); + return; + } + printf("\n======================== PORT CDR INFO =======================\n"); printf("direct\t|addr |lane |type |mode |status \n"); printf("----------------------------------------------------------------------------\n"); -- 2.45.0.windows.1