From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from NAM01-BN3-obe.outbound.protection.outlook.com (mail-bn3nam01on0078.outbound.protection.outlook.com [104.47.33.78]) by dpdk.org (Postfix) with ESMTP id B1D3E2E41 for ; Mon, 20 Aug 2018 08:49:28 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vmware.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2P7+j3goFJdXJbAnG3QWyZz5Fl/LXf++MFi0ZVQjXuk=; b=VAadofTuj6XCrrm4taLkFqlbnVesqDgMDqz7wo8CEnfnKF/MPpkqyHIXHWIClPch5CrUSonKur8hmWBcH4ib2eE51LlQERTzRulJcdquqxtPtS9+kUtJLoC6NQtzCRFtg/I27Dw4mGK8IGooylzhTyXeFLyN6OrPadT/XiTrXPM= Received: from sc2-edge-ivybridge-12.eng.vmware.com (66.170.99.2) by CO2PR05MB2487.namprd05.prod.outlook.com (2603:10b6:102:10::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1080.10; Mon, 20 Aug 2018 06:46:50 +0000 From: Jia Yu To: jyu@vmware.com Cc: stable@dpdk.org Date: Sun, 19 Aug 2018 22:10:50 -0700 Message-Id: <1534741850-8189-1-git-send-email-jyu@vmware.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [66.170.99.2] X-ClientProxiedBy: DM5PR16CA0003.namprd16.prod.outlook.com (2603:10b6:3:c0::13) To CO2PR05MB2487.namprd05.prod.outlook.com (2603:10b6:102:10::17) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 53156989-bef3-46d4-43e2-08d60668b519 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(7020095)(4652040)(8989137)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:CO2PR05MB2487; X-Microsoft-Exchange-Diagnostics: 1; CO2PR05MB2487; 3:+uqOh0WAYSLj0kaNaNoDsgrKsLCFYX8o9dhZcXTrJxSXefVgXJfEWsKC5VFOutlrwzXdb62LUOYEpP1pNOEhiJXivwbEDfQ5mE7NuMxE4Kikct4cDOFFsGK2hoMNfA+OgMZVx/n3YcvHBLYWnWGD8tIhRwFZKiiIFQALouoqE4Ubc5g9X3TGZUekAxjEo2oT9zaxumJVZyVCkzfErwFaZCPTLW1xPx/qR0o4fU7whdGeR5oJ9FXTTxLhIcwocSrE; 25:M+FCgNRTCmmLSMQ2BdzVYLgzZhZlv549cYzaZ0MIJZhHbK3THjJ1kEZJO9Sr2c+IL4+q5xRwHtUHsmWeaC3vHr10TcqoT3ee1pduv2rBjqejvOwR7vnvvDvYGQKADVAzFbXj66mm1p+BAziQXib+a4M61bUVj5fyvxdPDfZU/ktdLJFvEakaM6LnY13p4xMQYLMZSWkBMntUp8OivG92kW38K6X15GFDxRXnTSufbWolvfSMjVF6g8Bhf+98OEC0MKfR7ZS7gn4I+f/O/cVL3eLG3yxYGrvlh1Rjqm0YYTGBpdceZcD94vzkJc2EQLnvtXx323xLx5LXiKLFWKA8bA==; 31:FTQxE2+SoUZ2QQsP3hdOzKgJM6xEQ+0+LWA7fXOvzErZpZ2H2TPvYX5Ylrm333fIXdueOhNVZDy+q62zhzDfliBDGLLqU1e/k8q6Gx86MGxxIy6xSW3aTYz1D3g5h5F/H5lO4/SKSHIeTFXjTiW9vGcZddzNMj1DF60ROjqKDYFh40my0hgKQHkEhlcKh/PZs0NpqW0thKhTnTp9cGNtLVFbGy1beJRH+61PXish3es= X-MS-TrafficTypeDiagnostic: CO2PR05MB2487: Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=jyu@vmware.com; BCL: 0 X-Microsoft-Exchange-Diagnostics: 1; CO2PR05MB2487; 20:XTEOUeczv5rNFUin6yW+v/r1HYksNccBgxC4DF11Vd+0/SjQpOPWPFF4sRP9W8usd7vC3leOD9fJeObk1G0QYp4KRzOmXf869o/6dtUFtiiY43LJvkmeoUbBjnSFxZTcf0bd89WNwefD+fx2i81swT6SJAIQRzlCZiouimjbGri1evsfC1PD37sM/vYc/40S+nok4MsRmiKAtJemW8rmrbWxgIfB1TTcG1SSazYOSY+1TS3CHhhSBKB/bouIngKfkxJQKof82WbMqUBtKIxL6oginqCn3FBZLL106M868LPwzQR8lZS2MvOlDUeoandgHooW3uUkf4OGJqqIVNsnrv3vOR7PCurD2MgIImRBKo+ooZL9oGZHlFhWMNvbiThG4baG7VdqDhHJvciGHtEBBFMtg+Tva0a69kv/SKhHM1yXEPPnIZZ0um6NRYjZz6H5JId9iNmdloAy+VgS2dD7tdVrSkGG3HJTza8xvywBoNbZc6xJ8HnzudTeBOQRWHrbrDWgEhA5qy8pzRi0FJFuN2L3k+YzGaYjhcZOA97IBPvmnCfDwB4D0jgYvnOgYmG3ZAwDCLKJ/Df18Su9iUR3RcisRUKJSXtUEUdosHSaOMg=; 4:+qScTs75Gdb9oebIAM6IOdtfcE8QT9oa/yxYJS5XLBzOtb0IHJXvzQJWXsrtIZMSZq9GBbBrutpMmY8IeGgMF/Fkiww8eaJWq6yEbD0UYn6wv81dXPOPhD4IiJXuQphXTwMIT9uJobIj+VDaek/InVRTxbgD8SVN6LvGB2AcKcASWlr7u4laquBgr8O1biW0XwKivnrUSacmo/69meVjUZGQSGvHl3NRd/ObaXtbg1atS0iA4UHMMHSU0sSN26zxZabWR7G2nZavlr7x2I403dIfbI7StLl123kL7rztbZcYFXwUt7J5N06ejf/S/xGe X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(61668805478150); X-MS-Exchange-SenderADCheck: 1 X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(823301075)(3231311)(944501410)(52105095)(10201501046)(93006095)(93001095)(3002001)(149027)(150027)(6041310)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123564045)(20161123562045)(20161123558120)(201708071742011)(7699016); SRVR:CO2PR05MB2487; BCL:0; PCL:0; RULEID:; SRVR:CO2PR05MB2487; X-Forefront-PRVS: 0770F75EA9 X-Forefront-Antispam-Report: SFV:NSPM; SFS:(10009020)(136003)(396003)(366004)(376002)(346002)(39860400002)(199004)(189003)(386003)(2616005)(446003)(305945005)(956004)(7696005)(5660300001)(47776003)(476003)(68736007)(97736004)(37006003)(86362001)(52116002)(36756003)(66066001)(16586007)(7736002)(316002)(11926002)(8936002)(3846002)(105586002)(6486002)(26005)(76176011)(2361001)(48376002)(34206002)(106356001)(6116002)(4326008)(11346002)(8676002)(486006)(50226002)(51416003)(16526019)(2906002)(478600001)(2351001)(25786009)(53936002)(81166006)(50466002)(81156014); DIR:OUT; SFP:1101; SCL:1; SRVR:CO2PR05MB2487; H:sc2-edge-ivybridge-12.eng.vmware.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; Received-SPF: None (protection.outlook.com: vmware.com does not designate permitted sender hosts) X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; CO2PR05MB2487; 23:Acr49aG1s+ZfR00b8mjc1E6lS4GouOoH6o+p5Kkzn?= =?us-ascii?Q?XG8t/2BfvKHr81GpRDoyVfp7nDZOnrnoBjM2V+ysXKUj3i8I+IwBkEqNN/HO?= =?us-ascii?Q?v4TPGMwGAfIp2KH6s0wjQJ/oPIBj3LhsrgcPduQf+EllxtsP+q2UhdTQRYAO?= =?us-ascii?Q?WqWdzZXlzlF1XsXYHd3Vzh1jWbF0ZmC4DsAwjkyNJnNK3cQukllfr/eAgf9r?= =?us-ascii?Q?n5KuxoREOdAsy7cYBFKXOWTvNxdMCNsbG0POaGAMUig3/yqiUnATFRdCpdoc?= =?us-ascii?Q?o+P5o+OsTJHxBsaK02ZUwomRBQS3scZ9AdNXZC1Ost/upRFcESGSGM3CVi3B?= =?us-ascii?Q?Nd6rBb3JuqecWDmWdIyXHLsAg1Iq4HES0kHTk1alFkIQ89G5SakUCpnE/OoI?= =?us-ascii?Q?qlu44YGlx9y5wk01neL7zWMz1gfRaR2H8PGzCBdxdYECyZsHFFb21rkp0obl?= =?us-ascii?Q?EE7SdGqActY11RgWEPgM9wH8pZetxfvfJtv7mVHwzo0r/7tznUl97G/V5P15?= =?us-ascii?Q?ll+depkAg6lQgr7mLbTZhkJfbccXcpA69/ndo+0M9k9assmTMm1deafu6YVN?= =?us-ascii?Q?2taFQiKy70IcDVVbFTucwd8sykO3D+vYTyjIcc2X0j95Z6ag6VSLz6QboEdg?= =?us-ascii?Q?97+NiWymDFKHr/0vA3shy6EPd/lL7yK18cH15AloN5JjXopE0Fn38Bf7Su/g?= =?us-ascii?Q?m3GhSLtIJv5Oo6gNyjTTnr+NMX0Syxc45l8pHjtqLCwDiBFqWUT2HX9uMe2g?= =?us-ascii?Q?AVI18isaxCbGGFupxV1yLn0g3q5zQQtwiYH6yoR+IcVnhbt2sFv20J8HTocb?= =?us-ascii?Q?u89zWnbO2W/14l9cFnXky6ugHvVF3QAmZmbO19PDtSn/zNjJxypdnVPZ934V?= =?us-ascii?Q?GBT+LyFB2fqVzPUm0ORHcAk7JNNAVgzEPvZu1gqy8eS341W0ASKYv++NkFut?= =?us-ascii?Q?+U9gJrO3UxRQCs4CKSFjvr6HtAwxf0VsVTLnbH+Lf13zq8ClJTcuMIxRJPFm?= =?us-ascii?Q?MOX9W1slDCY1kiF/I+NpsekeOGLmY9YpFzwWK7eH8e+7uyXkJEnWV1ejslwz?= =?us-ascii?Q?zOvr1LlypnqK3rnhfx7AU6yUQxu6jlgHfdWiotL+hgriEFnNTt5dlJ22uUXq?= =?us-ascii?Q?4F2RntqFhirMMIVvfxiFd+O2OjmCFKoy+Ct06vCKvqCqG+wnCWIVSYp3ljSp?= =?us-ascii?Q?gvFe/sTpXLuwhY=3D?= X-Microsoft-Antispam-Message-Info: nc0cnRTBOZBTH7e+fMjXmbA/IF9I9i4F683l8GsTy9KpRXM3ycVPNyU6SHGzYDZkVwYdATFBcyBMnlBAfyNiiaWsGaMZ9/KF3LFP73woYLL1CDAxy7u3J71zELLrBrzOmVU8HDEv5gNaqA8TCYkobLJb/GHQAe1ZW+t9kdnmntDyUffesPaCs/ha+r/ZEA0ryRkbTghIjd/rP+hAGxKhMpafbzhW5IJ/yehWxcN76qYMXwIU7eepIrzbmSgSmyLBCRpwIuQQV3+aWrSbhNlWSyX7komXUAWli/edCNEDB9wmMldJewcveaUUf31VDQt3xTLuBz24yRc//dL6XGbWsgDrZZ5mIiWNv6mbRZ1+nsM= X-Microsoft-Exchange-Diagnostics: 1; CO2PR05MB2487; 6:KWE/eBzg03Za156iltXfS2EDrjo8v5pe1CS3qNuloXf23vpvo5KeMN1rTFsPXbUeJCFFpFI3J4VPNMpRuqX7NdtXJi57bP2Uq3zSPXtw6KQs56ZXtf1qAVsKaSaR74sjhrwxMTPKIL3b3KL+m5dO761mvclN4F0vm5BZosr5QGEqUKUTFEV5zdZY4vCYAaXEhUf+J4ESxh4/96eSsOm4QXQxNIu1r6QdArUmqTNRVXPv6ECeDlGyvsbhqEeA3YX7UjSWVTnmVPr08MrNAU3KFqwMX2yFQ6lgcy1gzU2JaOzYyTyfQqtY3HLsm7ub1VNdoCBw715ekjIelgUB6GUdhLJiaVMFG9ljDK1pR+J32TafEKBWXAY7M2LdfdGK0Pl0tPDocRm4pacfEF9fDHRdIfDltRDlYICxXKJJ0enosQ3OOhRAtGNkpWBvxrZ+RphjgB2bPxH3j3rSdbGW+nvhzQ==; 5:Tm2470BakkZhAeSk7Mns53ggs4hDxhqBhA0VAC+5zNYfepqXDxJWr5YDAgAzmODbJfbKcf0VrO+TglhDLFrsXN3Bg+Kq9Hycc+e2ViNPqYD48o3UpWeOeDo1fIUAnfsV6QepJZIH3tqTH88n7eUOsOGAMaiMi/8h8/6znxxPj1w=; 7:mLY2Uml60oKrM31LG4kbebtqJpKEPwDt2myOcCj2SHDWC1VKlj2yve0LuLkSGPKmaPqbIQKwWkmfZAldvVFRAahqsKbKJYI9ZmTrLIjF1bYFBKMoZaWkDXxrI8NI6Q3Q9MP2F7WrL8NxjbkAVvltwK8CvcVXtl3jF0taR6ndlJv+AN/3+QML+HAR26Xq4gTWOnoo/mXiMX1Xg4QIYrAg+2xm0Tf8hcPiMh5LL8fQRlCP3efZwbBXhvehdVj3UeG8 SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; CO2PR05MB2487; 20:/2YCUo+20EMoqMP2P2RHhwkjDKtOFtASO/1fRep9FxLMM4tND9bOsHN1Z1fAvYke0ahQErm95tCgmb1abLUfAHgpcQYZUxvcJ8q6eOYNtTb/7gVcX1mYH1+o9OoNkLyf38s0GubiWrcWxS6CVHZ7kIBavN4RIyxVOC9+QF6tVSc= X-OriginatorOrg: vmware.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2018 06:46:50.0763 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 53156989-bef3-46d4-43e2-08d60668b519 X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: b39138ca-3cee-4b4a-a4d6-cd83d9dd62f0 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO2PR05MB2487 Subject: [dpdk-stable] [PATCH v2] net/bonding: fix buf corruption in merging un-transmitted packets X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Aug 2018 06:49:29 -0000 When bond slave devices cannot transmit all packets in bufs array, tx_burst callback shall merge the un-transmitted packets back to bufs array. Recent merge logic introduced a bug which causes invalid mbuf addresses being written to bufs array. When caller frees the un-transmitted packets, due to invalid addresses, application will crash. The fix is avoid shifting mbufs, and directly write un-transmitted packets back to bufs array. Fixes: 09150784a776 ("net/bonding: burst mode hash calculation") Cc: stable@dpdk.org Signed-off-by: Jia Yu --- drivers/net/bonding/rte_eth_bond_pmd.c | 116 +++++++-------------------------- 1 file changed, 23 insertions(+), 93 deletions(-) diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c index 58f7377..c745f31 100644 --- a/drivers/net/bonding/rte_eth_bond_pmd.c +++ b/drivers/net/bonding/rte_eth_bond_pmd.c @@ -300,10 +300,10 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs, /* Mapping array generated by hash function to map mbufs to slaves */ uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 }; - uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 }; + uint16_t slave_tx_count; uint16_t total_tx_count = 0, total_tx_fail_count = 0; - uint16_t i, j; + uint16_t i; if (unlikely(nb_bufs == 0)) return 0; @@ -358,34 +358,12 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs, /* If tx burst fails move packets to end of bufs */ if (unlikely(slave_tx_count < slave_nb_bufs[i])) { - slave_tx_fail_count[i] = slave_nb_bufs[i] - + int slave_tx_fail_count = slave_nb_bufs[i] - slave_tx_count; - total_tx_fail_count += slave_tx_fail_count[i]; - - /* - * Shift bufs to beginning of array to allow reordering - * later - */ - for (j = 0; j < slave_tx_fail_count[i]; j++) { - slave_bufs[i][j] = - slave_bufs[i][(slave_tx_count - 1) + j]; - } - } - } - - /* - * If there are tx burst failures we move packets to end of bufs to - * preserve expected PMD behaviour of all failed transmitted being - * at the end of the input mbuf array - */ - if (unlikely(total_tx_fail_count > 0)) { - int bufs_idx = nb_bufs - total_tx_fail_count - 1; - - for (i = 0; i < slave_count; i++) { - if (slave_tx_fail_count[i] > 0) { - for (j = 0; j < slave_tx_fail_count[i]; j++) - bufs[bufs_idx++] = slave_bufs[i][j]; - } + total_tx_fail_count += slave_tx_fail_count; + memcpy(&bufs[nb_bufs - total_tx_fail_count], + &slave_bufs[i][slave_tx_count], + slave_tx_fail_count * sizeof(bufs[0])); } } @@ -715,8 +693,8 @@ bond_ethdev_tx_burst_round_robin(void *queue, struct rte_mbuf **bufs, tx_fail_total += tx_fail_slave; memcpy(&bufs[nb_pkts - tx_fail_total], - &slave_bufs[i][num_tx_slave], - tx_fail_slave * sizeof(bufs[0])); + &slave_bufs[i][num_tx_slave], + tx_fail_slave * sizeof(bufs[0])); } num_tx_total += num_tx_slave; } @@ -1221,10 +1199,10 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs, /* Mapping array generated by hash function to map mbufs to slaves */ uint16_t bufs_slave_port_idxs[nb_bufs]; - uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 }; + uint16_t slave_tx_count; uint16_t total_tx_count = 0, total_tx_fail_count = 0; - uint16_t i, j; + uint16_t i; if (unlikely(nb_bufs == 0)) return 0; @@ -1265,34 +1243,12 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs, /* If tx burst fails move packets to end of bufs */ if (unlikely(slave_tx_count < slave_nb_bufs[i])) { - slave_tx_fail_count[i] = slave_nb_bufs[i] - + int slave_tx_fail_count = slave_nb_bufs[i] - slave_tx_count; - total_tx_fail_count += slave_tx_fail_count[i]; - - /* - * Shift bufs to beginning of array to allow reordering - * later - */ - for (j = 0; j < slave_tx_fail_count[i]; j++) { - slave_bufs[i][j] = - slave_bufs[i][(slave_tx_count - 1) + j]; - } - } - } - - /* - * If there are tx burst failures we move packets to end of bufs to - * preserve expected PMD behaviour of all failed transmitted being - * at the end of the input mbuf array - */ - if (unlikely(total_tx_fail_count > 0)) { - int bufs_idx = nb_bufs - total_tx_fail_count - 1; - - for (i = 0; i < slave_count; i++) { - if (slave_tx_fail_count[i] > 0) { - for (j = 0; j < slave_tx_fail_count[i]; j++) - bufs[bufs_idx++] = slave_bufs[i][j]; - } + total_tx_fail_count += slave_tx_fail_count; + memcpy(&bufs[nb_bufs - total_tx_fail_count], + &slave_bufs[i][slave_tx_count], + slave_tx_fail_count * sizeof(bufs[0])); } } @@ -1319,10 +1275,10 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs, /* Mapping array generated by hash function to map mbufs to slaves */ uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 }; - uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 }; + uint16_t slave_tx_count; uint16_t total_tx_count = 0, total_tx_fail_count = 0; - uint16_t i, j; + uint16_t i; if (unlikely(nb_bufs == 0)) return 0; @@ -1380,39 +1336,13 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs, /* If tx burst fails move packets to end of bufs */ if (unlikely(slave_tx_count < slave_nb_bufs[i])) { - slave_tx_fail_count[i] = slave_nb_bufs[i] - + int slave_tx_fail_count = slave_nb_bufs[i] - slave_tx_count; - total_tx_fail_count += slave_tx_fail_count[i]; - - /* - * Shift bufs to beginning of array to allow - * reordering later - */ - for (j = 0; j < slave_tx_fail_count[i]; j++) - slave_bufs[i][j] = - slave_bufs[i] - [(slave_tx_count - 1) - + j]; - } - } + total_tx_fail_count += slave_tx_fail_count; - /* - * If there are tx burst failures we move packets to end of - * bufs to preserve expected PMD behaviour of all failed - * transmitted being at the end of the input mbuf array - */ - if (unlikely(total_tx_fail_count > 0)) { - int bufs_idx = nb_bufs - total_tx_fail_count - 1; - - for (i = 0; i < slave_count; i++) { - if (slave_tx_fail_count[i] > 0) { - for (j = 0; - j < slave_tx_fail_count[i]; - j++) { - bufs[bufs_idx++] = - slave_bufs[i][j]; - } - } + memcpy(&bufs[nb_bufs - total_tx_fail_count], + &slave_bufs[i][slave_tx_count], + slave_tx_fail_count * sizeof(bufs[0])); } } } -- 2.7.4