[dpdk-dev] [Bug 818] [asan] hash: buffer overflow in hash_autotest

[dpdk-dev] [Bug 818] [asan] hash: buffer overflow in hash_autotest

[bugzilla]

https://bugs.dpdk.org/show_bug.cgi?id=818

            Bug ID: 818
           Summary: [asan] hash: buffer overflow in hash_autotest
           Product: DPDK
           Version: unspecified
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: other
          Assignee: dev@dpdk.org
          Reporter: david.marchand@redhat.com
                CC: bruce.richardson@intel.com,
                    vladimir.medvedkin@intel.com, yipeng1.wang@intel.com
  Target Milestone: ---

This issue was caught by ASAN.
To reproduce, please look at the last patch of series 18997:

https://github.com/ovsrobot/dpdk/commit/series_18997


30/94 DPDK:fast-tests / hash_autotest         FAIL     0.97 s (exit status 1)

--- command ---
DPDK_TEST='hash_autotest' /home/runner/work/dpdk/dpdk/build/app/test/dpdk-test
-l 0-1 --file-prefix=hash_autotest
--- stdout ---
RTE>>hash_autotest
--- stderr ---
EAL: Detected 2 lcore(s)
EAL: Detected 1 NUMA nodes
EAL: Detected shared linkage of DPDK
EAL: WARNING! Base virtual address hint (0x100005000 != 0x7f890e95a000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: Multi-process socket /var/run/dpdk/hash_autotest/mp_socket
EAL: Selected IOVA mode 'PA'
EAL: No available 1048576 kB hugepages reported
EAL: VFIO support initialized
EAL: WARNING! Base virtual address hint (0x10000b000 != 0x7f88fd558000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100011000 != 0x7f88fd39f000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100a12000 != 0x7f84fb800000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100c17000 != 0x7f88fd33e000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x101618000 != 0x7f80fb600000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x10181d000 != 0x7f88fd19f000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x10221e000 != 0x7f7cfb400000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x102423000 != 0x7f88fd13e000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x102e24000 != 0x7f78fb200000) not
respected!
EAL:    This may cause issues with mapping memory into secondary processes
APP: HPET is not enabled, using TSC as default timer
=================================================================
==25013==ERROR: AddressSanitizer: global-buffer-overflow on address
0x0000037220f0 at pc 0x0000014a8de4 bp 0x7ffe74374b30 sp 0x7ffe74374b28
READ of size 4 at 0x0000037220f0 thread T0
    #0 0x14a8de3 in __rte_jhash_2hashes
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:104:9
    #1 0x14abb53 in rte_jhash_32b_2hashes
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:259:2
    #2 0x14aba71 in rte_jhash_32b
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:307:2
    #3 0x7f890a546627 in rte_hash_hash
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_cuckoo_hash.c:538:9
    #4 0x7f890a555672 in rte_hash_add_key
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_cuckoo_hash.c:1212:46
    #5 0x1497373 in test_hash_add_delete_2_jhash2
/home/runner/work/dpdk/dpdk/build/../app/test/test_hash.c:1666:9
    #6 0x14968e0 in test_hash
/home/runner/work/dpdk/dpdk/build/../app/test/test_hash.c:2187:6
    #7 0x4d6166 in cmd_autotest_parsed
/home/runner/work/dpdk/dpdk/build/../app/test/commands.c:71:10
    #8 0x7f890b0b46c5 in cmdline_parse
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_parse.c:290:3
    #9 0x7f890b0ad8d5 in cmdline_valid_buffer
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:26:8
    #10 0x7f890b0bef07 in rdline_char_in
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_rdline.c:421:5
    #11 0x7f890b0ae03f in cmdline_in
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:149:9
    #12 0x5ac68e in main
/home/runner/work/dpdk/dpdk/build/../app/test/test.c:214:8
    #13 0x7f890370bbf6 in __libc_start_main
/build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
    #14 0x42ea19 in _start
(/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x42ea19)

0x0000037220f0 is located 48 bytes to the left of global variable
'hashtest_funcs' defined in '../app/test/test_hash.c:36:26' (0x3722120) of size
16
0x0000037220f0 is located 0 bytes to the right of global variable 'key' defined
in '../app/test/test_hash.c:1596:16' (0x37220e0) of size 16
SUMMARY: AddressSanitizer: global-buffer-overflow
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:104:9 in
__rte_jhash_2hashes
Shadow bytes around the buggy address:
  0x0000806dc3c0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000806dc3d0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000806dc3e0: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 01 f9 f9 f9
  0x0000806dc3f0: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
  0x0000806dc400: 00 00 00 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
=>0x0000806dc410: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00[f9]f9
  0x0000806dc420: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000806dc430: 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000806dc440: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000806dc450: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
  0x0000806dc460: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==25013==ABORTING
-------

-- 
You are receiving this mail because:
You are the assignee for the bug.