• Maor Dickman's avatar
    net/mlx5e: CT, Fix coverity issue · 2b021989
    Maor Dickman authored
    The cited commit introduced the following coverity issue at function
    mlx5_tc_ct_rule_to_tuple_nat:
    - Memory - corruptions (OVERRUN)
      Overrunning array "tuple->ip.src_v6.in6_u.u6_addr32" of 4 4-byte
      elements at element index 7 (byte offset 31) using index
      "ip6_offset" (which evaluates to 7).
    
    In case of IPv6 destination address rewrite, ip6_offset values are
    between 4 to 7, which will cause memory overrun of array
    "tuple->ip.src_v6.in6_u.u6_addr32" to array
    "tuple->ip.dst_v6.in6_u.u6_addr32".
    
    Fixed by writing the value directly to array
    "tuple->ip.dst_v6.in6_u.u6_addr32" in case ip6_offset values are
    between 4 to 7.
    
    Fixes: bc562be9 ("net/mlx5e: CT: Save ct entries tuples in hashtables")
    Signed-off-by: default avatarMaor Dickman <maord@nvidia.com>
    Reviewed-by: default avatarRoi Dayan <roid@nvidia.com>
    Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
    2b021989
tc_ct.c 51.1 KB