[PATCH] examples/qos_sched: fix buffer overflow on mbuf free

[PATCH] examples/qos_sched: fix buffer overflow on mbuf free

[Bruce Richardson]

When running the qos_sched app with separated worker and Tx threads, the
app would seg-fault after a short time of handling packets. The root
cause of this turns out to be an incorrect array index when freeing
unsent packets post-Tx. Rather than freeing packets using the "nb_tx"
value i.e. where transmission failed, the function was freeing packets
using the "nb_pkts" value, i.e. going beyond the number of packets
previously received into the buffer.

Fixes: 39b25117c40b ("examples/qos_sched: remove Tx buffering")

Reported-by: Megha Ajmera <megha.ajmera@intel.com>
Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
---
 examples/qos_sched/app_thread.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/qos_sched/app_thread.c b/examples/qos_sched/app_thread.c
index 1ea732aa91..059c470afb 100644
--- a/examples/qos_sched/app_thread.c
+++ b/examples/qos_sched/app_thread.c
@@ -118,7 +118,7 @@ app_tx_thread(struct thread_conf **confs)
 		if (likely(nb_pkts != 0)) {
 			uint16_t nb_tx = rte_eth_tx_burst(conf->tx_port, 0, mbufs, nb_pkts);
 			if (nb_pkts != nb_tx)
-				rte_pktmbuf_free_bulk(&mbufs[nb_pkts], nb_pkts - nb_tx);
+				rte_pktmbuf_free_bulk(&mbufs[nb_tx], nb_pkts - nb_tx);
 		}
 
 		conf_idx++;
-- 
2.37.2

RE: [PATCH] examples/qos_sched: fix buffer overflow on mbuf free

[Dumitrescu, Cristian]

> -----Original Message-----
> From: Richardson, Bruce <bruce.richardson@intel.com>
> Sent: Wednesday, March 8, 2023 2:09 PM
> To: dev@dpdk.org
> Cc: Richardson, Bruce <bruce.richardson@intel.com>; Ajmera, Megha
> <megha.ajmera@intel.com>; Dumitrescu, Cristian
> <cristian.dumitrescu@intel.com>
> Subject: [PATCH] examples/qos_sched: fix buffer overflow on mbuf free
> 
> When running the qos_sched app with separated worker and Tx threads, the
> app would seg-fault after a short time of handling packets. The root
> cause of this turns out to be an incorrect array index when freeing
> unsent packets post-Tx. Rather than freeing packets using the "nb_tx"
> value i.e. where transmission failed, the function was freeing packets
> using the "nb_pkts" value, i.e. going beyond the number of packets
> previously received into the buffer.
> 
> Fixes: 39b25117c40b ("examples/qos_sched: remove Tx buffering")
> 
> Reported-by: Megha Ajmera <megha.ajmera@intel.com>
> Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
> ---
>  examples/qos_sched/app_thread.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/examples/qos_sched/app_thread.c
> b/examples/qos_sched/app_thread.c
> index 1ea732aa91..059c470afb 100644
> --- a/examples/qos_sched/app_thread.c
> +++ b/examples/qos_sched/app_thread.c

Acked-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com>

Re: [PATCH] examples/qos_sched: fix buffer overflow on mbuf free

[Thomas Monjalon]

> > When running the qos_sched app with separated worker and Tx threads, the
> > app would seg-fault after a short time of handling packets. The root
> > cause of this turns out to be an incorrect array index when freeing
> > unsent packets post-Tx. Rather than freeing packets using the "nb_tx"
> > value i.e. where transmission failed, the function was freeing packets
> > using the "nb_pkts" value, i.e. going beyond the number of packets
> > previously received into the buffer.
> > 
> > Fixes: 39b25117c40b ("examples/qos_sched: remove Tx buffering")
> > 
> > Reported-by: Megha Ajmera <megha.ajmera@intel.com>
> > Signed-off-by: Bruce Richardson <bruce.richardson@intel.com>
> 
> Acked-by: Cristian Dumitrescu <cristian.dumitrescu@intel.com>

Applied, thanks.