patches for DPDK stable branches
 help / color / Atom feed
From: Alexander Kozyrev <>
Subject: [dpdk-stable] [PATCH] mbuf: fix external mbufs pool boundaries
Date: Mon,  1 Jun 2020 15:24:16 +0000
Message-ID: <> (raw)

Memzones are created in testpmd in order to test external data
buffers functionality. Each memzone is 2Mb in size and divided among
the pool of external memory buffers.

Memzone may not always be fully utilized because mbufs size can vary
and some space can be left unused at the tail of a memzone. This is
not handled properly and mbuf can get the address of this leftover
space since this address is still valid (part of memzone), but there
is not enough space to fit the whole packet data. As a result packet
data may overflow and cause the memory corruption.

Take mbuf size into account when distributing memory addresses from
a memzone to external mbufs. Skip the remaining tail in case there
is not enough room for a packet and move to a next memzone instead.

Fixes: 6c8e50c2e5 ("mbuf: create pool with external memory buffers")
Signed-off-by: Alexander Kozyrev <>
Acked-by: Viacheslav Ovsiienko <>
 lib/librte_mbuf/rte_mbuf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c
index 220eb2f..ae91ae2 100644
--- a/lib/librte_mbuf/rte_mbuf.c
+++ b/lib/librte_mbuf/rte_mbuf.c
@@ -191,14 +191,14 @@ struct rte_pktmbuf_extmem_init_ctx {
 	ext_mem = ctx->ext_mem + ctx->ext;
 	RTE_ASSERT(ctx->ext < ctx->ext_num);
-	RTE_ASSERT(ctx->off < ext_mem->buf_len);
+	RTE_ASSERT(ctx->off + ext_mem->elt_size <= ext_mem->buf_len);
 	m->buf_addr = RTE_PTR_ADD(ext_mem->buf_ptr, ctx->off);
 	m->buf_iova = ext_mem->buf_iova == RTE_BAD_IOVA ?
 		      RTE_BAD_IOVA : (ext_mem->buf_iova + ctx->off);
 	ctx->off += ext_mem->elt_size;
-	if (ctx->off >= ext_mem->buf_len) {
+	if (ctx->off + ext_mem->elt_size > ext_mem->buf_len) {
 		ctx->off = 0;

             reply index

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-06-01 15:24 Alexander Kozyrev [this message]
2020-06-08  7:50 ` Olivier Matz
2020-06-11  7:27   ` Thomas Monjalon

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

patches for DPDK stable branches

Archives are clonable:
	git clone --mirror stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ \
	public-inbox-index stable

Newsgroup available over NNTP:

AGPL code for this site: git clone public-inbox