From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 5F35F4590E; Thu, 5 Sep 2024 14:55:43 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 4113C42D6A; Thu, 5 Sep 2024 14:55:43 +0200 (CEST) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mails.dpdk.org (Postfix) with ESMTP id 289A340684 for ; Thu, 5 Sep 2024 14:55:42 +0200 (CEST) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-2d89dbb60bdso511672a91.1 for ; Thu, 05 Sep 2024 05:55:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1725540941; x=1726145741; darn=dpdk.org; h=cc:to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=ebCxGbkTr9m0f//GM7A/hazMuskWQW5VrKc5YNB32mU=; b=E7tEnealWvLRr3uUQmp/R6Funpeu9OnVmkKxBRvFQf6SABz49eTxwMLjYNTD6yL2mf mPBXD/6Rw6yqvZfipZ8Pu8CtB6bauycx64S7Vpk/YQplLJfrMN29QwH0tX4e6tTwHCPR 36jv/kU/pEBbvxplUDmvFajRv2uCSGUMLaYGWqUQ3eurH5SMeEhg1lrdNXkcpyfiAQGG C2HCbES/404dUSH6ZsUbBRMCK1CK5RQEE+dIpDqQAOYhR+4ydy3Xxfe5M9mvOLhACoDQ IiYaQhc20Lk5U54xcV+58/mMmhQyLaODnbMZfhKinWSeVFI8ql4d5zE/OYVcHoGwzy9n OeXA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1725540941; x=1726145741; h=cc:to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=ebCxGbkTr9m0f//GM7A/hazMuskWQW5VrKc5YNB32mU=; b=BG7/eCKVODTweB/hcamE2jLCSVmuLbIm95cU4Ol+aH0BypKex1GcsgiIbHJ0QkJf0z jXgjDZkCZI+kT+kfxhabxOzEIZ7dSVYyjHbk7vvL4hMZyLzoPrXZpaGHfrW+PC90k1/e fjp3RMEKwb66FEfUxInuOA2qrdQZ8q1q+4szFpwbzhzKYzYL/c7YXLWf89qhy/nAOStP 4D1PNU0ENTGbMwhRApy90VoCEIeXTQip9RkVxshaRMS36EciUujtByZnmVsQxjsz0CKb hLswuZJ7f37TuyMjU8MD2JU9eJm8xRuK71oLu2t/Az6rVe3tA9asgOuB8dBi/ZCl/S3J ObOw== X-Gm-Message-State: AOJu0YwKlp3t+j1w4k2n3K/A+DWqtCPXoB6EN4SSzN1CpZPZbu7tVIyk GgCxsOq/AbOMBH2cEW1Nqxyo2YFoOS08fY8HY6v4TcNLoyQ8++DN4p/U2SJHLZh5oHfRpaZf1Sr YfGfisiy6m8WtWn1/RGeg5QZ49Z32OGDpn4mil4ufZGcVxg2DkK0= X-Google-Smtp-Source: AGHT+IHGByyHx+WRbkk+SPnMEjdy7Kc2GzpkahXh9VhD64oqJxV7MdFGu6kH1JYY4TBB+GgnWBoRb/C+EQ6QM5rrsMY= X-Received: by 2002:a17:90b:24a:b0:2d8:a9af:b94f with SMTP id 98e67ed59e1d1-2d8a9afbb93mr15735704a91.7.1725540941065; Thu, 05 Sep 2024 05:55:41 -0700 (PDT) MIME-Version: 1.0 From: Edwin Brossette Date: Thu, 5 Sep 2024 14:55:29 +0200 Message-ID: Subject: Crash in tap pmd when using more than 8 rx queues To: dev@dpdk.org Cc: Olivier Matz , Didier Pallard , Laurent Hardy , kparameshwar@vmware.com, ferruh.yigit@intel.com Content-Type: multipart/alternative; boundary="000000000000d695e806215ece36" X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org --000000000000d695e806215ece36 Content-Type: text/plain; charset="UTF-8" Hello, I have recently stumbled into an issue with my DPDK-based application running the failsafe pmd. This pmd uses a tap device, with which my application fails to start if more than 8 rx queues are used. This issue appears to be related to this patch: https://git.dpdk.org/dpdk/commit/?id=c36ce7099c2187926cd62cff7ebd479823554929 I have seen in the documentation that there was a limitation to 8 max queues shared when using a tap device shared between multiple processes. However, my application uses a single primary process, with no secondary process, but it appears that I am still running into this limitation. Now if we look at this small chunk of code: memset(&msg, 0, sizeof(msg)); strlcpy(msg.name, TAP_MP_REQ_START_RXTX, sizeof(msg.name)); strlcpy(request_param->port_name, dev->data->name, sizeof(request_param->port_name)); msg.len_param = sizeof(*request_param); for (i = 0; i < dev->data->nb_tx_queues; i++) { msg.fds[fd_iterator++] = process_private->txq_fds[i]; msg.num_fds++; request_param->txq_count++; } for (i = 0; i < dev->data->nb_rx_queues; i++) { msg.fds[fd_iterator++] = process_private->rxq_fds[i]; msg.num_fds++; request_param->rxq_count++; } (Note that I am not using the latest DPDK version, but stable v23.11.1. But I believe the issue is still present on latest.) There are no checks on the maximum value i can take in the for loops. Since the size of msg.fds is limited by the maximum of 8 queues shared between process because of the IPC API, there is a potential buffer overflow which can happen here. See the struct declaration: struct rte_mp_msg { char name[RTE_MP_MAX_NAME_LEN]; int len_param; int num_fds; uint8_t param[RTE_MP_MAX_PARAM_LEN]; int fds[RTE_MP_MAX_FD_NUM]; }; This means that if the number of queues used is more than 8, the program will crash. This is what happens on my end as I get the following log: *** stack smashing detected ***: terminated Reverting the commit mentionned above fixes my issue. Also setting a check like this works for me: if (dev->data->nb_tx_queues + dev->data->nb_rx_queues > RTE_MP_MAX_FD_NUM) return -1; I've made the changes on my local branch to fix my issue. This mail is just to bring attention on this problem. Thank you in advance for considering it. Regards, Edwin Brossette. --000000000000d695e806215ece36 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello,

I have recently stumbled into an issue with = my DPDK-based application running the failsafe pmd. This pmd uses a tap dev= ice, with which my application fails to start if more than 8 rx queues are = used. This issue appears to be related to this patch:
h= ttps://git.dpdk.org/dpdk/commit/?id=3Dc36ce7099c2187926cd62cff7ebd479823554= 929

I have seen in the documentation that there was a limitation= to 8 max queues shared when using a tap device shared between multiple pro= cesses. However, my application uses a single primary process, with no seco= ndary process, but it appears that I am still running into this limitation.=

Now if we look at this small chunk of code:

memset(&msg= , 0, sizeof(msg));
strlcpy(msg.name, TA= P_MP_REQ_START_RXTX, sizeof(msg.name));
= strlcpy(request_param->port_name, dev->data->name, sizeof(request= _param->port_name));
msg.len_param =3D sizeof(*request_param);
f= or (i =3D 0; i < dev->data->nb_tx_queues; i++) {
=C2=A0=C2=A0= =C2=A0 msg.fds[fd_iterator++] =3D process_private->txq_fds[i];
=C2=A0= =C2=A0=C2=A0 msg.num_fds++;
=C2=A0=C2=A0=C2=A0 request_param->txq_cou= nt++;
}
for (i =3D 0; i < dev->data->nb_rx_queues; i++) {<= br>=C2=A0=C2=A0=C2=A0 msg.fds[fd_iterator++] =3D process_private->rxq_fd= s[i];
=C2=A0=C2=A0=C2=A0 msg.num_fds++;
=C2=A0=C2=A0=C2=A0 request_pa= ram->rxq_count++;
}
(Note that I am not using the latest DPDK ver= sion, but stable v23.11.1. But I believe the issue is still present on late= st.)

There are no checks on the maximum value i can take in the for = loops. Since the size of msg.fds is limited by the maximum of 8 queues shar= ed between process because of the IPC API, there is a potential buffer over= flow which can happen here.

See the struct declaration:
struct r= te_mp_msg {
=C2=A0=C2=A0=C2=A0=C2=A0 char name[RTE_MP_MAX_NAME_LEN];
= =C2=A0=C2=A0=C2=A0=C2=A0 int len_param;
=C2=A0=C2=A0=C2=A0=C2=A0 int num= _fds;
=C2=A0=C2=A0=C2=A0=C2=A0 uint8_t param[RTE_MP_MAX_PARAM_LEN];
= =C2=A0=C2=A0=C2=A0=C2=A0 int fds[RTE_MP_MAX_FD_NUM];
};

This mea= ns that if the number of queues used is more than 8, the program will crash= . This is what happens on my end as I get the following log:
*** stack s= mashing detected ***: terminated

Reverting the commit mentionned abo= ve fixes my issue. Also setting a check like this works for me:

if = (dev->data->nb_tx_queues + dev->data->nb_rx_queues > RTE_MP_= MAX_FD_NUM)
=C2=A0=C2=A0=C2=A0=C2=A0 return -1;

I've made the= changes on my local branch to fix my issue. This mail is just to bring att= ention on this problem.
Thank you in advance for considering it.

= Regards,
Edwin Brossette.


--000000000000d695e806215ece36--