From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from COL004-OMC2S8.hotmail.com (col004-omc2s8.hotmail.com [65.55.34.82]) by dpdk.org (Postfix) with ESMTP id 61A585689 for ; Thu, 21 Jul 2016 21:09:49 +0200 (CEST) Received: from APC01-PU1-obe.outbound.protection.outlook.com ([65.55.34.71]) by COL004-OMC2S8.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Thu, 21 Jul 2016 12:09:48 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=pP8ROW9HJSC3FfkfNJh1d6q/EnT0hPa8xKkfYJaLtXE=; b=CVDvRFeMo8OhE1OK9bcTzlHNLxR3fVCISz3LGN5rSk4eZytKU8VwGdx6Rv/1xFoOqtCUzaTvsiWHkShgIlYITIIi+poE9Qy/voT0TVqNwsESxR9+Uvafzm+ftK0YuLR3/9mzc8iooHVNoO4CnEg9zSuTwhcT+uyD6O7gFioixJh0lXx318JswgpzOajS6LLoPdDlzGKz/aMF7YIZtFLA4THhRG1aC4nikS5/OxnkeXB9HB71ogTl2DzTWKOAAoh7wwXNCMl1Xm5jWajwXYh74iUdSZc8Mn99s5TQPFVKl/DUQUNxTV8RbaQN0Zt06xnNc5CJcaLi1J4UETyocAw9ww== Received: from PU1APC01FT060.eop-APC01.prod.protection.outlook.com (10.152.252.57) by PU1APC01HT253.eop-APC01.prod.protection.outlook.com (10.152.252.250) with Microsoft SMTP Server (TLS) id 15.1.523.9; Thu, 21 Jul 2016 19:09:45 +0000 Received: from SG2PR0201MB0998.apcprd02.prod.outlook.com (10.152.252.57) by PU1APC01FT060.mail.protection.outlook.com (10.152.253.44) with Microsoft SMTP Server (TLS) id 15.1.539.16 via Frontend Transport; Thu, 21 Jul 2016 19:09:44 +0000 Received: from SG2PR0201MB0998.apcprd02.prod.outlook.com ([10.162.202.157]) by SG2PR0201MB0998.apcprd02.prod.outlook.com ([10.162.202.157]) with mapi id 15.01.0549.003; Thu, 21 Jul 2016 19:09:42 +0000 From: bynes adam To: Ilya Maximets CC: "dev@dpdk.org" , Helin Zhang , Jingjing Wu , Zhe Tao , Heetae Ahn , Thomas Monjalon , Sergey Dyasly Thread-Topic: [dpdk-dev] [PATCH] net/i40e: fix out-of-bounds writes during vector Rx Thread-Index: AQHR44NvF4nLY6V/oEOhUKqh5NGzaw== Date: Thu, 21 Jul 2016 19:09:42 +0000 Message-ID: References: <1469099018-31402-1-git-send-email-i.maximets@samsung.com> In-Reply-To: <1469099018-31402-1-git-send-email-i.maximets@samsung.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=softfail (sender IP is 10.152.252.57) smtp.mailfrom=outlook.com; samsung.com; dkim=none (message not signed) header.d=none;samsung.com; dmarc=fail action=none header.from=outlook.com; received-spf: SoftFail (protection.outlook.com: domain of transitioning outlook.com discourages use of 10.152.252.57 as permitted sender) x-ms-exchange-messagesentrepresentingtype: 1 x-eopattributedmessage: 0 x-forefront-antispam-report: CIP:10.152.252.57; IPV:NLI; CTRY:; EFV:NLI; SFV:NSPM; SFS:(10019020)(98900003); DIR:OUT; SFP:1102; SCL:1; SRVR:PU1APC01HT253; H:SG2PR0201MB0998.apcprd02.prod.outlook.com; FPR:; SPF:None; CAT:NONE; LANG:en; CAT:NONE; x-microsoft-exchange-diagnostics: 1; PU1APC01HT253; 6:OgAnQFt5cqEYmcZUXqmBXqo7m0UwZK0nkmZ3J5YjAscpAoyy37v2cKQ9hypKYBj1PnrrDp1DQVJibqSIgoC4/YlvE7pT8YGL9Zl1D2iZTjOr00vh52J4sIyGOltDmpoaY9gZR/dVf/27MklQLpUphLCgtkflR/osNm2fbjiBtEGSMj2jAF58SGa0UJqnbbQYCO7cmvZMbGk9WaN6ezHdRiML08q2jkZG4bj0NrizERY5e0fszBXFKMvu2ppmtkVjFcjUOaKJ8d2cvT3UiWThmcipFU/4gjiWY970K86cQLNZXVf1AjuU/JfAzHPk6wIYwSA1eZwrEl/AuceGey/0Nw==; 5:QRsKGrKnz81R6xEyjh4gwMEh5WsXHxjmBD3RJukm4rDoBTdSDzuyG261wi4cOh4QEAIModFz+tkL4WdmJpJf4KIbJJjTS/AUZP/7JvL3HGVRwgMKeZqeQIop6iT8CtOl9VEHVqaRwvLCo2ur8a10sQ==; 24:1L4tsEhFHrgoRLipZNoS7zXmRqdYKH9PQOPFNTrPDmw/IJHVhRhdMVtre8O54vKr02tp9MZdnT0R7EeJ7Uarwuoi32iu/UP2yAsAWHnq+Nk=; 7:Irlmq22JSLyFYZWPCuNB6uFUmVqn1pqT6706HxPKr2XxLiAMGlfWvukxoKgn+77ieQKjXnHOwhyRkevq1XZyj2Kf8jkAFeBEV8+m6GVSLVKgcMQEjyAVL36dpEZefjJWkYAOa9lAJG9r2w0PHfA9usf5+fQvtZJ0c0mZQMBYBk6zSuY1EGtvloA0HVB9h/D2eVuvwUeeAJ3JIhx1hmFLcO73/gpj1ZcKQjr+TXvqPL3WHzl3UrKLi2qsmX8AlZNR x-ms-office365-filtering-correlation-id: 8df7c85d-b520-4ff2-cbed-08d3b19a9022 x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(1601124038)(5061506196)(5061507196)(1603103041)(1603101187)(1601125047); SRVR:PU1APC01HT253; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(432015012)(82015046); SRVR:PU1APC01HT253; BCL:0; PCL:0; RULEID:; SRVR:PU1APC01HT253; x-forefront-prvs: 0010D93EFE spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: text/plain; charset="us-ascii" Content-ID: <72317C482908B34C912BA74DA8D40C81@apcprd02.prod.outlook.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2016 19:09:42.9052 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: PU1APC01HT253 X-OriginalArrivalTime: 21 Jul 2016 19:09:48.0869 (UTC) FILETIME=[7383BF50:01D1E383] Subject: Re: [dpdk-dev] [PATCH] net/i40e: fix out-of-bounds writes during vector Rx X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Jul 2016 19:09:50 -0000 On Thu, Jul 21, 2016 at 02:03:38PM +0300, Ilya Maximets wrote: > From: Sergey Dyasly >=20 > Rx loop inside _recv_raw_pkts_vec() ignores nb_pkts argument and always > tries to receive RTE_I40E_VPMD_RX_BURST (32) packets. This is a violation > of rte_eth_rx_burst() API and can lead to memory corruption (out-of-bound= s > writes to struct rte_mbuf **rx_pkts) if nb_pkts is less than 32. >=20 > Fix this by actually using nb_pkts inside the loop. >=20 > Fixes: 9ed94e5bb04e ("i40e: add vector Rx") >=20 > Signed-off-by: Sergey Dyasly > Acked-by: Ilya Maximets > --- > drivers/net/i40e/i40e_rxtx_vec.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) >=20 > diff --git a/drivers/net/i40e/i40e_rxtx_vec.c b/drivers/net/i40e/i40e_rxt= x_vec.c > index 05cb415..51fb282 100644 > --- a/drivers/net/i40e/i40e_rxtx_vec.c > +++ b/drivers/net/i40e/i40e_rxtx_vec.c > @@ -269,7 +269,7 @@ _recv_raw_pkts_vec(struct i40e_rx_queue *rxq, struct = rte_mbuf **rx_pkts, > * D. fill info. from desc to mbuf > */ > =20 > - for (pos =3D 0, nb_pkts_recd =3D 0; pos < RTE_I40E_VPMD_RX_BURST; > + for (pos =3D 0, nb_pkts_recd =3D 0; pos < nb_pkts; > pos +=3D RTE_I40E_DESCS_PER_LOOP, > rxdp +=3D RTE_I40E_DESCS_PER_LOOP) { > __m128i descs[RTE_I40E_DESCS_PER_LOOP]; > --=20 > 2.7.4 Acked-by: Adam Bynes