From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 672DD4287A; Fri, 31 Mar 2023 03:17:52 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id ED3C840EDB; Fri, 31 Mar 2023 03:17:51 +0200 (CEST) Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178]) by mails.dpdk.org (Postfix) with ESMTP id A9ECF40223 for ; Fri, 31 Mar 2023 03:17:50 +0200 (CEST) Received: by inbox.dpdk.org (Postfix, from userid 33) id 9470E4287B; Fri, 31 Mar 2023 03:17:50 +0200 (CEST) From: bugzilla@dpdk.org To: dev@dpdk.org Subject: [Bug 1206] Multiple large memory block allocations using rte_malloc can lead to memory out-of-bounds issues. Date: Fri, 31 Mar 2023 01:17:50 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: DPDK X-Bugzilla-Component: core X-Bugzilla-Version: 21.11 X-Bugzilla-Keywords: X-Bugzilla-Severity: major X-Bugzilla-Who: killerstemp@gmail.com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: Normal X-Bugzilla-Assigned-To: dev@dpdk.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: multipart/alternative; boundary=16802254700.bDAC3AfE.3336806 Content-Transfer-Encoding: 7bit X-Bugzilla-URL: http://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org --16802254700.bDAC3AfE.3336806 Date: Fri, 31 Mar 2023 03:17:50 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All https://bugs.dpdk.org/show_bug.cgi?id=3D1206 Bug ID: 1206 Summary: Multiple large memory block allocations using rte_malloc can lead to memory out-of-bounds issues. Product: DPDK Version: 21.11 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: major Priority: Normal Component: core Assignee: dev@dpdk.org Reporter: killerstemp@gmail.com Target Milestone: --- [root@localhost bin]# lscpu Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 8 On-line CPU(s) list: 0-7 Thread(s) per core: 2 Core(s) per socket: 4 Socket(s): 1 NUMA node(s): 1 Vendor ID: GenuineIntel CPU family: 6 Model: 58 Model name: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz Stepping: 9 CPU MHz: 3700.073 CPU max MHz: 3900.0000 CPU min MHz: 1600.0000 BogoMIPS: 6784.24 Virtualization: VT-x L1d cache: 32K L1i cache: 32K L2 cache: 256K L3 cache: 8192K NUMA node0 CPU(s): 0-7 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge= mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx= est tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm epb ssbd ibrs ibpb tpr_shadow vnmi flexpriority ept vpid fsgsbase smep erms xsaveopt dtherm ida arat pln pts [root@localhost bin]#=20 Not supported pdpe1gb There are many free 2M HugePages. HugePages_Total: 6656 HugePages_Free: 5682 HugePages_Rsvd: 0 HugePages_Surp: 0 Hugepagesize: 2048 kB DirectMap4k: 236476 kB DirectMap2M: 33228800 kB test code char * t_mem1; char * t_mem2; int t_size =3D 1024*1024*1024; t_mem1 =3D rte_malloc(NULL,t_size,RTE_CACHE_LINE_SIZE); t_mem2 =3D rte_malloc(NULL,t_size,RTE_CACHE_LINE_SIZE); printf("rte_malloc1 t_mem1=3D%p \n",t_mem1); printf("rte_malloc1 t_mem2=3D%p \n",t_mem2);=20=20=20=20=20=20 memset(t_mem1,0,t_size); memset(t_mem2,1,t_size);=20=20=20=20=20=20=20=20 int t_i; for(t_i=3D0;t_i
Bug ID 1206
Summary Multiple large memory block allocations using rte_malloc can = lead to memory out-of-bounds issues.
Product DPDK
Version 21.11
Hardware x86
OS Linux
Status UNCONFIRMED
Severity major
Priority Normal
Component core
Assignee dev@dpdk.org
Reporter killerstemp@gmail.com
Target Milestone --- 

[root@localhost bin]# lscpu
Architecture:          x86_64
CPU op-mode(s):        32-bit, 64-bit
Byte Order:            Little Endian
CPU(s):                8
On-line CPU(s) list:   0-7
Thread(s) per core:    2
Core(s) per socket:    4
Socket(s):             1
NUMA node(s):          1
Vendor ID:             GenuineIntel
CPU family:            6
Model:                 58
Model name:            Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Stepping:              9
CPU MHz:               3700.073
CPU max MHz:           3900.0000
CPU min MHz:           1600.0000
BogoMIPS:              6784.24
Virtualization:        VT-x
L1d cache:             32K
L1i cache:             32K
L2 cache:              256K
L3 cache:              8192K
NUMA node0 CPU(s):     0-7
Flags:                 fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge=
 mca
cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx
rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology
nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx=
 est
tm2 ssse3 cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer
aes xsave avx f16c rdrand lahf_lm epb ssbd ibrs ibpb tpr_shadow vnmi
flexpriority ept vpid fsgsbase smep erms xsaveopt dtherm ida arat pln pts
[root@localhost bin]#=20

Not supported pdpe1gb



There are many free 2M HugePages.

HugePages_Total:    6656
HugePages_Free:     5682
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:       2048 kB
DirectMap4k:      236476 kB
DirectMap2M:    33228800 kB




test code

  char * t_mem1;
  char * t_mem2;
        int t_size =3D 1024*1024*1024;
        t_mem1 =3D rte_malloc(NULL,t_size,RTE_CACHE_LINE_SIZE);
        t_mem2 =3D rte_malloc(NULL,t_size,RTE_CACHE_LINE_SIZE);
        printf("rte_malloc1 t_mem1=3D%p \n",t_mem1);
        printf("rte_malloc1 t_mem2=3D%p \n",t_mem2);=20=20=20=20=
=20=20

        memset(t_mem1,0,t_size);
        memset(t_mem2,1,t_size);=20=20=20=20=20=20=20=20

        int t_i;
        for(t_i=3D0;t_i<t_size;t_i++)
        {
                if (t_mem1[t_i] =3D=3D1)
                {
                        printf("rte_malloc find t_mem1=3D%p error t_i=
=3D%d
%p=3D%d\n",t_mem1, t_i,&t_mem1[t_i],t_mem1[t_i] );
                        t_mem1[t_i] =3D 2;
                        break;
                }
        }
        for(t_i=3D0;t_i<t_size;t_i++)
        {
                if (t_mem2[t_i] =3D=3D2)
                {
                        printf("rte_malloc find t_mem2=3D%p error t_i=
=3D%d
%p=3D%d\n",t_mem2, t_i,&t_mem2[t_i],t_mem2[t_i] );
                        break;
                }
        }

run print:

rte_malloc1 t_mem1=3D0x107c00000=20
rte_malloc1 t_mem2=3D0x140c00000=20
rte_malloc find t_mem1=3D0x107c00000 error t_i=3D956301312 0x140c00000=3D1
rte_malloc find t_mem2=3D0x140c00000 error t_i=3D0 0x140c00000=3D2

The two allocated blocks of memory overlap partially.

You are receiving this mail because:
  • You are the assignee for the bug.
=20=20=20=20=20=20=20=20=20=20
= --16802254700.bDAC3AfE.3336806--