From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 2F1EB4401C; Mon, 13 May 2024 18:24:16 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id CD6F24067D; Mon, 13 May 2024 18:24:15 +0200 (CEST) Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178]) by mails.dpdk.org (Postfix) with ESMTP id 0B9CC4067C for ; Mon, 13 May 2024 18:24:14 +0200 (CEST) Received: by inbox.dpdk.org (Postfix, from userid 33) id F2EE54401D; Mon, 13 May 2024 18:24:13 +0200 (CEST) From: bugzilla@dpdk.org To: dev@dpdk.org Subject: [DPDK/ethdev Bug 1440] use after free in af_xdp Date: Mon, 13 May 2024 16:24:13 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: DPDK X-Bugzilla-Component: ethdev X-Bugzilla-Version: 24.03 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: stephen@networkplumber.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: Normal X-Bugzilla-Assigned-To: dev@dpdk.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: multipart/alternative; boundary=17156174530.cA8Abb.3904024 Content-Transfer-Encoding: 7bit X-Bugzilla-URL: http://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org --17156174530.cA8Abb.3904024 Date: Mon, 13 May 2024 18:24:13 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All https://bugs.dpdk.org/show_bug.cgi?id=3D1440 Bug ID: 1440 Summary: use after free in af_xdp Product: DPDK Version: 24.03 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: Normal Component: ethdev Assignee: dev@dpdk.org Reporter: stephen@networkplumber.org Target Milestone: --- #if defined(XDP_UMEM_UNALIGNED_CHUNK_FLAG) static uint16_t af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) { ... for (i =3D 0; i < nb_pkts; i++) { mbuf =3D bufs[i]; if (mbuf->pool =3D=3D umem->mb_pool) { ... } else { ... desc->addr =3D addr | offset; rte_memcpy(pkt, rte_pktmbuf_mtod(mbuf, void *), desc->len); rte_pktmbuf_free(mbuf); count++; } tx_bytes +=3D mbuf->pkt_len; <<< use after free above --=20 You are receiving this mail because: You are the assignee for the bug.= --17156174530.cA8Abb.3904024 Date: Mon, 13 May 2024 18:24:13 +0200 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All

Bug ID	1440
Summary	use after free in af_xdp
Product	DPDK
Version	24.03
Hardware	All
OS	All
Status	UNCONFIRMED
Severity	normal
Priority	Normal
Component	ethdev
Assignee	dev@dpdk.org
Reporter	stephen@networkplumber.org
Target Milestone	---

#if defined(XDP_UMEM_UNALIGNED_CHU=
NK_FLAG)
static uint16_t
af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
{

...
        for (i =3D 0; i < nb_pkts; i++) {
                mbuf =3D bufs[i];

                if (mbuf->pool =3D=3D umem->mb_pool) {
...
                } else {
...
                        desc->addr =3D addr | offset;
                        rte_memcpy(pkt, rte_pktmbuf_mtod(mbuf, void *),
                                        desc->len);
                        rte_pktmbuf_free(mbuf);
                        count++;
                }

                tx_bytes +=3D mbuf->pkt_len; <<< use after free=
 above

You are receiving this mail because:

You are the assignee for the bug.

=20=20=20=20=20=20=20=20=20=20

= --17156174530.cA8Abb.3904024--