patches for DPDK stable branches
 help / color / Atom feed
* [dpdk-stable] [PATCH] mbuf: fix external mbufs pool boundaries
@ 2020-06-01 15:24 Alexander Kozyrev
  2020-06-08  7:50 ` Olivier Matz
  0 siblings, 1 reply; 3+ messages in thread
From: Alexander Kozyrev @ 2020-06-01 15:24 UTC (permalink / raw)
  To: dev; +Cc: stable, rasland, viacheslavo, olivier.matz

Memzones are created in testpmd in order to test external data
buffers functionality. Each memzone is 2Mb in size and divided among
the pool of external memory buffers.

Memzone may not always be fully utilized because mbufs size can vary
and some space can be left unused at the tail of a memzone. This is
not handled properly and mbuf can get the address of this leftover
space since this address is still valid (part of memzone), but there
is not enough space to fit the whole packet data. As a result packet
data may overflow and cause the memory corruption.

Take mbuf size into account when distributing memory addresses from
a memzone to external mbufs. Skip the remaining tail in case there
is not enough room for a packet and move to a next memzone instead.

Fixes: 6c8e50c2e5 ("mbuf: create pool with external memory buffers")
Cc: stable@dpdk.org
Signed-off-by: Alexander Kozyrev <akozyrev@mellanox.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo@mellanox.com>
---
 lib/librte_mbuf/rte_mbuf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c
index 220eb2f..ae91ae2 100644
--- a/lib/librte_mbuf/rte_mbuf.c
+++ b/lib/librte_mbuf/rte_mbuf.c
@@ -191,14 +191,14 @@ struct rte_pktmbuf_extmem_init_ctx {
 	ext_mem = ctx->ext_mem + ctx->ext;
 
 	RTE_ASSERT(ctx->ext < ctx->ext_num);
-	RTE_ASSERT(ctx->off < ext_mem->buf_len);
+	RTE_ASSERT(ctx->off + ext_mem->elt_size <= ext_mem->buf_len);
 
 	m->buf_addr = RTE_PTR_ADD(ext_mem->buf_ptr, ctx->off);
 	m->buf_iova = ext_mem->buf_iova == RTE_BAD_IOVA ?
 		      RTE_BAD_IOVA : (ext_mem->buf_iova + ctx->off);
 
 	ctx->off += ext_mem->elt_size;
-	if (ctx->off >= ext_mem->buf_len) {
+	if (ctx->off + ext_mem->elt_size > ext_mem->buf_len) {
 		ctx->off = 0;
 		++ctx->ext;
 	}
-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [dpdk-stable] [PATCH] mbuf: fix external mbufs pool boundaries
  2020-06-01 15:24 [dpdk-stable] [PATCH] mbuf: fix external mbufs pool boundaries Alexander Kozyrev
@ 2020-06-08  7:50 ` Olivier Matz
  2020-06-11  7:27   ` Thomas Monjalon
  0 siblings, 1 reply; 3+ messages in thread
From: Olivier Matz @ 2020-06-08  7:50 UTC (permalink / raw)
  To: Alexander Kozyrev; +Cc: dev, stable, rasland, viacheslavo

On Mon, Jun 01, 2020 at 03:24:16PM +0000, Alexander Kozyrev wrote:
> Memzones are created in testpmd in order to test external data
> buffers functionality. Each memzone is 2Mb in size and divided among
> the pool of external memory buffers.
> 
> Memzone may not always be fully utilized because mbufs size can vary
> and some space can be left unused at the tail of a memzone. This is
> not handled properly and mbuf can get the address of this leftover
> space since this address is still valid (part of memzone), but there
> is not enough space to fit the whole packet data. As a result packet
> data may overflow and cause the memory corruption.
> 
> Take mbuf size into account when distributing memory addresses from
> a memzone to external mbufs. Skip the remaining tail in case there
> is not enough room for a packet and move to a next memzone instead.
> 
> Fixes: 6c8e50c2e5 ("mbuf: create pool with external memory buffers")
> Cc: stable@dpdk.org
> Signed-off-by: Alexander Kozyrev <akozyrev@mellanox.com>
> Acked-by: Viacheslav Ovsiienko <viacheslavo@mellanox.com>

Acked-by: Olivier Matz <olivier.matz@6wind.com>

Thanks!

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [dpdk-stable] [PATCH] mbuf: fix external mbufs pool boundaries
  2020-06-08  7:50 ` Olivier Matz
@ 2020-06-11  7:27   ` Thomas Monjalon
  0 siblings, 0 replies; 3+ messages in thread
From: Thomas Monjalon @ 2020-06-11  7:27 UTC (permalink / raw)
  To: Alexander Kozyrev; +Cc: stable, dev, rasland, viacheslavo, Olivier Matz

08/06/2020 09:50, Olivier Matz:
> On Mon, Jun 01, 2020 at 03:24:16PM +0000, Alexander Kozyrev wrote:
> > Memzones are created in testpmd in order to test external data
> > buffers functionality. Each memzone is 2Mb in size and divided among
> > the pool of external memory buffers.
> > 
> > Memzone may not always be fully utilized because mbufs size can vary
> > and some space can be left unused at the tail of a memzone. This is
> > not handled properly and mbuf can get the address of this leftover
> > space since this address is still valid (part of memzone), but there
> > is not enough space to fit the whole packet data. As a result packet
> > data may overflow and cause the memory corruption.
> > 
> > Take mbuf size into account when distributing memory addresses from
> > a memzone to external mbufs. Skip the remaining tail in case there
> > is not enough room for a packet and move to a next memzone instead.
> > 
> > Fixes: 6c8e50c2e5 ("mbuf: create pool with external memory buffers")
> > Cc: stable@dpdk.org
> > Signed-off-by: Alexander Kozyrev <akozyrev@mellanox.com>
> > Acked-by: Viacheslav Ovsiienko <viacheslavo@mellanox.com>
> 
> Acked-by: Olivier Matz <olivier.matz@6wind.com>

Applied, thanks

Note: there is a blank line between Fixes/Cc block and Signed/Acked block.



^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-01 15:24 [dpdk-stable] [PATCH] mbuf: fix external mbufs pool boundaries Alexander Kozyrev
2020-06-08  7:50 ` Olivier Matz
2020-06-11  7:27   ` Thomas Monjalon

patches for DPDK stable branches

Archives are clonable:
	git clone --mirror http://inbox.dpdk.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ http://inbox.dpdk.org/stable \
		stable@dpdk.org
	public-inbox-index stable


Newsgroup available over NNTP:
	nntp://inbox.dpdk.org/inbox.dpdk.stable


AGPL code for this site: git clone https://public-inbox.org/ public-inbox