[PATCH] app/dma-perf: fix dma mapping access overruns

[PATCH] app/dma-perf: fix dma mapping access overruns

[Mingjin Ye]

The dma map supports a maximum of `MAX_WORKER_NB=128`. Initializing
the dma map allows a maximum support of `MAX_WORKER_NB=256`. This results
in memory access out-of-bounds when the actual dma entries exceed
MAX_WORKER_NB.

This patch talks about MAX_WORKER_NB and MAX_WORKER_NB size set to 256 to
fix this.

Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
 app/test-dma-perf/main.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/test-dma-perf/main.h b/app/test-dma-perf/main.h
index f65e264378..602ecac858 100644
--- a/app/test-dma-perf/main.h
+++ b/app/test-dma-perf/main.h
@@ -10,11 +10,12 @@
 #include <rte_cycles.h>
 #include <rte_dev.h>
 
-#define MAX_WORKER_NB 128
+#define MAX_WORKER_NB 256
 #define MAX_OUTPUT_STR_LEN 512
 
 #define MAX_DMA_NB 128
-#define MAX_LCORE_NB 256
+/* Note that MAX_LCORE_NB <= MAX_WORKER_NB */
+#define MAX_LCORE_NB MAX_WORKER_NB
 
 extern char output_str[MAX_WORKER_NB + 1][MAX_OUTPUT_STR_LEN];
 
-- 
2.25.1

[PATCH v2] app/dma-perf: fix lcores array out of bounds access

[Mingjin Ye]

The default size of the lcores array in the lcore dma map
is MAX_WORKER_NB. However, when parsing configuration
parameters, MAX_LCORE_NB is used as a constraint.
Since MAX_LCORE_NB is greater than MAX_WORKER_NB, this
causes array access to go out of bounds when the value
of the `lcore_dma/lcore` configuration item in the
parameter file is greater than MAX_WORKER_NB.

This patch fixes the issue by removing the MAX_LCORE_NB
macro and using MAX_WORKER_NB consistently.

Fixes: 623dc9364dc6 ("app/dma-perf: introduce DMA performance test")

Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>
---
v2:A better solution.
---
 app/test-dma-perf/main.c | 4 ++--
 app/test-dma-perf/main.h | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/app/test-dma-perf/main.c b/app/test-dma-perf/main.c
index e5bccc27da..5f8bab8f45 100644
--- a/app/test-dma-perf/main.c
+++ b/app/test-dma-perf/main.c
@@ -177,7 +177,7 @@ parse_lcore(struct test_configure *test_case, const char *value)
 
 	char *token = strtok(input, ", ");
 	while (token != NULL) {
-		if (lcore_dma_map->cnt >= MAX_LCORE_NB) {
+		if (lcore_dma_map->cnt >= MAX_WORKER_NB) {
 			free(input);
 			return -1;
 		}
@@ -248,7 +248,7 @@ parse_lcore_dma(struct test_configure *test_case, const char *value)
 		}
 
 		lcore_dma_map = &test_case->lcore_dma_map;
-		if (lcore_dma_map->cnt >= MAX_LCORE_NB) {
+		if (lcore_dma_map->cnt >= MAX_WORKER_NB) {
 			fprintf(stderr, "lcores count error\n");
 			ret = -1;
 			break;
diff --git a/app/test-dma-perf/main.h b/app/test-dma-perf/main.h
index f65e264378..62085e6e8f 100644
--- a/app/test-dma-perf/main.h
+++ b/app/test-dma-perf/main.h
@@ -14,7 +14,6 @@
 #define MAX_OUTPUT_STR_LEN 512
 
 #define MAX_DMA_NB 128
-#define MAX_LCORE_NB 256
 
 extern char output_str[MAX_WORKER_NB + 1][MAX_OUTPUT_STR_LEN];
 
-- 
2.25.1

RE: [EXT] [PATCH v2] app/dma-perf: fix lcores array out of bounds access

[Gowrishankar Muthukrishnan]

Looks good to me.
Acked-by: Gowrishankar Muthukrishnan <gmuthukrishn@marvell.com>

Re: [PATCH v2] app/dma-perf: fix lcores array out of bounds access

[Thomas Monjalon]

26/10/2023 11:53, Mingjin Ye:
> The default size of the lcores array in the lcore dma map
> is MAX_WORKER_NB. However, when parsing configuration
> parameters, MAX_LCORE_NB is used as a constraint.
> Since MAX_LCORE_NB is greater than MAX_WORKER_NB, this
> causes array access to go out of bounds when the value
> of the `lcore_dma/lcore` configuration item in the
> parameter file is greater than MAX_WORKER_NB.
> 
> This patch fixes the issue by removing the MAX_LCORE_NB
> macro and using MAX_WORKER_NB consistently.
> 
> Fixes: 623dc9364dc6 ("app/dma-perf: introduce DMA performance test")
> 
> Signed-off-by: Mingjin Ye <mingjinx.ye@intel.com>

Applied, thanks.