From: Kevin Traynor <ktraynor@redhat.com>
To: Jia Yu <jyu@vmware.com>
Cc: Chas Williams <chas3@att.com>, dpdk stable <stable@dpdk.org>
Subject: [dpdk-stable] patch 'net/bonding: fix buffer corruption in packets' has been queued to stable release 18.08.1
Date: Tue, 20 Nov 2018 19:12:10 +0000 [thread overview]
Message-ID: <20181120191252.30277-20-ktraynor@redhat.com> (raw)
In-Reply-To: <20181120191252.30277-1-ktraynor@redhat.com>
Hi,
FYI, your patch has been queued to stable release 18.08.1
Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 11/23/18. So please
shout if anyone has objections.
Also note that after the patch there's a diff of the upstream commit vs the patch applied
to the branch. If the code is different (ie: not only metadata diffs), due for example to
a change in context or macro names, please double check it.
Thanks.
Kevin Traynor
---
>From 6e4c82467cdef208fb4c0404e920e7f090d4bb30 Mon Sep 17 00:00:00 2001
From: Jia Yu <jyu@vmware.com>
Date: Sun, 19 Aug 2018 22:18:45 -0700
Subject: [PATCH] net/bonding: fix buffer corruption in packets
[ upstream commit 6b2a47de074a0a6abc9a7c8d1aaa2a66898b7b48 ]
When bond slave devices cannot transmit all packets in bufs array,
tx_burst callback shall merge the un-transmitted packets back to
bufs array. Recent merge logic introduced a bug which causes
invalid mbuf addresses being written to bufs array.
When caller frees the un-transmitted packets, due to invalid addresses,
application will crash.
The fix is avoid shifting mbufs, and directly write un-transmitted
packets back to bufs array.
Fixes: 09150784a776 ("net/bonding: burst mode hash calculation")
Signed-off-by: Jia Yu <jyu@vmware.com>
Acked-by: Chas Williams <chas3@att.com>
---
drivers/net/bonding/rte_eth_bond_pmd.c | 116 +++++--------------------
1 file changed, 23 insertions(+), 93 deletions(-)
diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c
index 441742258..b84f32263 100644
--- a/drivers/net/bonding/rte_eth_bond_pmd.c
+++ b/drivers/net/bonding/rte_eth_bond_pmd.c
@@ -302,8 +302,8 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs,
uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
- uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
+ uint16_t slave_tx_count;
uint16_t total_tx_count = 0, total_tx_fail_count = 0;
- uint16_t i, j;
+ uint16_t i;
if (unlikely(nb_bufs == 0))
@@ -360,32 +360,10 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs,
/* If tx burst fails move packets to end of bufs */
if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
- slave_tx_fail_count[i] = slave_nb_bufs[i] -
+ int slave_tx_fail_count = slave_nb_bufs[i] -
slave_tx_count;
- total_tx_fail_count += slave_tx_fail_count[i];
-
- /*
- * Shift bufs to beginning of array to allow reordering
- * later
- */
- for (j = 0; j < slave_tx_fail_count[i]; j++) {
- slave_bufs[i][j] =
- slave_bufs[i][(slave_tx_count - 1) + j];
- }
- }
- }
-
- /*
- * If there are tx burst failures we move packets to end of bufs to
- * preserve expected PMD behaviour of all failed transmitted being
- * at the end of the input mbuf array
- */
- if (unlikely(total_tx_fail_count > 0)) {
- int bufs_idx = nb_bufs - total_tx_fail_count - 1;
-
- for (i = 0; i < slave_count; i++) {
- if (slave_tx_fail_count[i] > 0) {
- for (j = 0; j < slave_tx_fail_count[i]; j++)
- bufs[bufs_idx++] = slave_bufs[i][j];
- }
+ total_tx_fail_count += slave_tx_fail_count;
+ memcpy(&bufs[nb_bufs - total_tx_fail_count],
+ &slave_bufs[i][slave_tx_count],
+ slave_tx_fail_count * sizeof(bufs[0]));
}
}
@@ -717,6 +695,6 @@ bond_ethdev_tx_burst_round_robin(void *queue, struct rte_mbuf **bufs,
memcpy(&bufs[nb_pkts - tx_fail_total],
- &slave_bufs[i][num_tx_slave],
- tx_fail_slave * sizeof(bufs[0]));
+ &slave_bufs[i][num_tx_slave],
+ tx_fail_slave * sizeof(bufs[0]));
}
num_tx_total += num_tx_slave;
@@ -1223,8 +1201,8 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs,
uint16_t bufs_slave_port_idxs[nb_bufs];
- uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
+ uint16_t slave_tx_count;
uint16_t total_tx_count = 0, total_tx_fail_count = 0;
- uint16_t i, j;
+ uint16_t i;
if (unlikely(nb_bufs == 0))
@@ -1267,32 +1245,10 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs,
/* If tx burst fails move packets to end of bufs */
if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
- slave_tx_fail_count[i] = slave_nb_bufs[i] -
+ int slave_tx_fail_count = slave_nb_bufs[i] -
slave_tx_count;
- total_tx_fail_count += slave_tx_fail_count[i];
-
- /*
- * Shift bufs to beginning of array to allow reordering
- * later
- */
- for (j = 0; j < slave_tx_fail_count[i]; j++) {
- slave_bufs[i][j] =
- slave_bufs[i][(slave_tx_count - 1) + j];
- }
- }
- }
-
- /*
- * If there are tx burst failures we move packets to end of bufs to
- * preserve expected PMD behaviour of all failed transmitted being
- * at the end of the input mbuf array
- */
- if (unlikely(total_tx_fail_count > 0)) {
- int bufs_idx = nb_bufs - total_tx_fail_count - 1;
-
- for (i = 0; i < slave_count; i++) {
- if (slave_tx_fail_count[i] > 0) {
- for (j = 0; j < slave_tx_fail_count[i]; j++)
- bufs[bufs_idx++] = slave_bufs[i][j];
- }
+ total_tx_fail_count += slave_tx_fail_count;
+ memcpy(&bufs[nb_bufs - total_tx_fail_count],
+ &slave_bufs[i][slave_tx_count],
+ slave_tx_fail_count * sizeof(bufs[0]));
}
}
@@ -1321,8 +1277,8 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs,
uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
- uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
+ uint16_t slave_tx_count;
uint16_t total_tx_count = 0, total_tx_fail_count = 0;
- uint16_t i, j;
+ uint16_t i;
if (unlikely(nb_bufs == 0))
@@ -1382,37 +1338,11 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs,
/* If tx burst fails move packets to end of bufs */
if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
- slave_tx_fail_count[i] = slave_nb_bufs[i] -
+ int slave_tx_fail_count = slave_nb_bufs[i] -
slave_tx_count;
- total_tx_fail_count += slave_tx_fail_count[i];
+ total_tx_fail_count += slave_tx_fail_count;
- /*
- * Shift bufs to beginning of array to allow
- * reordering later
- */
- for (j = 0; j < slave_tx_fail_count[i]; j++)
- slave_bufs[i][j] =
- slave_bufs[i]
- [(slave_tx_count - 1)
- + j];
- }
- }
-
- /*
- * If there are tx burst failures we move packets to end of
- * bufs to preserve expected PMD behaviour of all failed
- * transmitted being at the end of the input mbuf array
- */
- if (unlikely(total_tx_fail_count > 0)) {
- int bufs_idx = nb_bufs - total_tx_fail_count - 1;
-
- for (i = 0; i < slave_count; i++) {
- if (slave_tx_fail_count[i] > 0) {
- for (j = 0;
- j < slave_tx_fail_count[i];
- j++) {
- bufs[bufs_idx++] =
- slave_bufs[i][j];
- }
- }
+ memcpy(&bufs[nb_bufs - total_tx_fail_count],
+ &slave_bufs[i][slave_tx_count],
+ slave_tx_fail_count * sizeof(bufs[0]));
}
}
--
2.19.0
---
Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- - 2018-11-20 17:53:07.950719862 +0000
+++ 0020-net-bonding-fix-buffer-corruption-in-packets.patch 2018-11-20 17:53:07.000000000 +0000
@@ -1,8 +1,10 @@
-From 6b2a47de074a0a6abc9a7c8d1aaa2a66898b7b48 Mon Sep 17 00:00:00 2001
+From 6e4c82467cdef208fb4c0404e920e7f090d4bb30 Mon Sep 17 00:00:00 2001
From: Jia Yu <jyu@vmware.com>
Date: Sun, 19 Aug 2018 22:18:45 -0700
Subject: [PATCH] net/bonding: fix buffer corruption in packets
+[ upstream commit 6b2a47de074a0a6abc9a7c8d1aaa2a66898b7b48 ]
+
When bond slave devices cannot transmit all packets in bufs array,
tx_burst callback shall merge the un-transmitted packets back to
bufs array. Recent merge logic introduced a bug which causes
@@ -14,7 +16,6 @@
packets back to bufs array.
Fixes: 09150784a776 ("net/bonding: burst mode hash calculation")
-Cc: stable@dpdk.org
Signed-off-by: Jia Yu <jyu@vmware.com>
Acked-by: Chas Williams <chas3@att.com>
next prev parent reply other threads:[~2018-11-20 19:14 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-20 19:11 [dpdk-stable] patch 'devtools: relax rule for identifying symbol section' " Kevin Traynor
2018-11-20 19:11 ` [dpdk-stable] patch 'mk: disable OcteonTx for buggy compilers only on arm64' " Kevin Traynor
2018-11-20 19:11 ` [dpdk-stable] patch 'build: enable ARM NEON flag when __aarch64__ defined' " Kevin Traynor
2018-11-20 19:11 ` [dpdk-stable] patch 'malloc: fix potential null pointer dereference' " Kevin Traynor
2018-11-20 19:11 ` [dpdk-stable] patch 'bus/vdev: fix error log on secondary device scan' " Kevin Traynor
2018-11-20 19:11 ` [dpdk-stable] patch 'acl: forbid rule with priority zero' " Kevin Traynor
2018-11-20 19:11 ` [dpdk-stable] patch 'net/bonding: support matching QinQ ethertype' " Kevin Traynor
2018-11-20 19:11 ` [dpdk-stable] patch 'net/netvsc: fix chimney buffer size error handling' " Kevin Traynor
2018-11-20 19:11 ` [dpdk-stable] patch 'net/netvsc: resize event buffer as needed' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/octeontx: fix packet corruption on Tx' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'doc: fix style and syntax in flow API guide' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/mlx5: fix artificial L4 limitation on switch flow rules' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/mlx5: disable ConnectX-4 Lx Multi Packet Send by default' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/mlx5: fix RSS flow action hash type selection' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/mvpp2: fix array initialization' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/mvpp2: fix comments and error messages' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'ethdev: fix MAC changes when live change not supported' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/nfp: fix live MAC changes " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'ethdev: fix port ownership logs' " Kevin Traynor
2018-11-20 19:12 ` Kevin Traynor [this message]
2018-11-20 19:12 ` [dpdk-stable] patch 'net/e1000: fix Tx offload capability typos' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/cxgbe: fix memory access when parsing flow match items' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/ixgbe: do not return internal code' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/mlx5: fix interrupt completion queue index wrapping' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'doc: fix wrong usage of bind command' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'examples/vhost: remove unnecessary constant' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'vhost: fix zmbufs array leak after NUMA realloc' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/virtio-user: check negotiated features before set' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'vhost: fix vhost interrupt support' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'vhost-user: drop connection on message handling failures' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'vhost: fix return value on enqueue path' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'ethdev: fix missing names in Tx offload name array' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/bonding: use evenly distributed default RSS RETA' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/bonding: do not ignore RSS key on device config' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'crypto/qat: fix typo' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'app/bbdev: fix inputs mbuf creation' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'compat: fix symbol version support with meson' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'eal: include missing hypervisor files in " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'raw/ifpga: use -Wno-error=format-security for " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/i40e: " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'igb_uio: install module when building with " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'build: create relative symlinks for PMDs in libdir' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'pdump: remove dependency on libpthread' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'fbarray: fix detach in --no-shconf mode' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'eal: do not allow legacy mode with --in-memory " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'app/testpmd: optimize mbuf pool allocation' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'config: remove unused parameter' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/e1000: fix queue number in RSS configuration' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/ifc: do not notify before HW ready' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/nfp: fix mbuf flags with checksum good' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/qede/base: fix to handle stag update event' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/qede: fix ethernet type in HW registers' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/qede/base: fix logic for sfp get/set' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/qede: fix flow director for IPv6 filter' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/qede: fix Rx buffer size calculation' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/qede/base: fix MFW FLR flow' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/virtio-user: fix deadlock in memory events callback' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/virtio-user: fix memory hotplug support in vhost-kernel' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/failsafe: fix crash on slave queue release' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net/failsafe: add checks for deferred queue setup' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'app/testpmd: fix missing jump action in flow action' " Kevin Traynor
2018-11-20 19:12 ` [dpdk-stable] patch 'net: fix Intel prepare function for IP checksum offload' " Kevin Traynor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181120191252.30277-20-ktraynor@redhat.com \
--to=ktraynor@redhat.com \
--cc=chas3@att.com \
--cc=jyu@vmware.com \
--cc=stable@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).