From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id C2EBBA0093 for ; Tue, 19 May 2020 15:15:59 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id BAB571D957; Tue, 19 May 2020 15:15:59 +0200 (CEST) Received: from mail-wm1-f67.google.com (mail-wm1-f67.google.com [209.85.128.67]) by dpdk.org (Postfix) with ESMTP id 59DE81D94A for ; Tue, 19 May 2020 15:15:58 +0200 (CEST) Received: by mail-wm1-f67.google.com with SMTP id m12so3045247wmc.0 for ; Tue, 19 May 2020 06:15:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=bwxETKCynKHQVVRoTt7JODaE73m8FZhMAfs9mod7rzI=; b=hPD2dvSVUImULY40Ss9MsLxYEI84uJW26hb5cRbctiR3bezLAbZhhJV+jsTdD2gu1U xRdoC11SB5YslYWNhpvwvkDP+fqPzqzlGbBxvbA9KenUsgke4Lcu8oNPVpk3EtBBXQ0o UiKbuN3LfBF3V3CnUjtqCfrWI6KxZHwbusjpiA50LJQdEd46kDi80MnqDuGuEbsq5183 PesieXzAvDnHVi0ZRtmcF++AMDEc+3X9hZIqeuEmfHyA89vyFedd1f8fnc5GlPjwbVE3 tX4lFjtMUE5kETkWr3ZYz67AOoIrEFIqq61kqIyKGBMgVKWTC64aUxENKdWI0vyWuoWy ORZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=bwxETKCynKHQVVRoTt7JODaE73m8FZhMAfs9mod7rzI=; b=m2lqCW3tiWVcDKjl1emBr0Pm0LQ2e0LLgkAO2JzN1s8dM+Fx5TEKG/dDmOHIZlcsYH sKS3K5tBfyrE2Q+GzcU4LCAHVZbsUiqckFHSn/W0skgV+WDKgZrFXUcmZSZqtBDpa2SX FJagiUEOG11fooSDB4PvuuZeDk55pQlWn+zE/Cxtvgw9Gznt9Yz2ORI+EX9rCFHJdipz g50buNiaKY2SH1hlO5lGIhNfuQ/JCBcnuE9wdqtxWoGpcsWRmfBqGrvR9XiNmNbh4Kj4 ZSHdP/YwU9So6hVkUC8Y0PQd6C9QpEcntUWHM8Mib3sRKn6PRss8ml7Of/9E73Yj7r0O xU0Q== X-Gm-Message-State: AOAM531RChD43XlqD7zpILtIFAcf1olnngeQ7ak3GuXQ+wQeoKoMIgWf bZq92rdkV7yZLOoLjvei5CRbhAHoC7m1bt3r X-Google-Smtp-Source: ABdhPJzSDiyevRQ+SqQl89SABi9+wDODAzgbR7hneehur23tV/HM+d2CX6V2UYTo36mK1YlS95rwuA== X-Received: by 2002:a1c:2302:: with SMTP id j2mr5370233wmj.18.1589894158118; Tue, 19 May 2020 06:15:58 -0700 (PDT) Received: from localhost ([88.98.246.218]) by smtp.gmail.com with ESMTPSA id 61sm8428589wrp.92.2020.05.19.06.15.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 May 2020 06:15:57 -0700 (PDT) From: luca.boccassi@gmail.com To: Stephen Hemminger Cc: Ferruh Yigit , dpdk stable Date: Tue, 19 May 2020 14:05:27 +0100 Message-Id: <20200519130549.112823-192-luca.boccassi@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200519130549.112823-1-luca.boccassi@gmail.com> References: <20200519125804.104349-1-luca.boccassi@gmail.com> <20200519130549.112823-1-luca.boccassi@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [dpdk-stable] patch 'net/tap: fix crash in flow destroy' has been queued to stable release 19.11.3 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" Hi, FYI, your patch has been queued to stable release 19.11.3 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 05/21/20. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Thanks. Luca Boccassi --- >From 2befb2f470b5141bead91c26d1220304b0667385 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Mon, 27 Apr 2020 14:39:26 -0700 Subject: [PATCH] net/tap: fix crash in flow destroy [ upstream commit 8451387df206f5ad34461280ab6a2e5bfe382b9b ] The TAP driver does not initialize all the elements of the rte_flow structure. This can lead to crash in rte_flow_destroy. (gdb) where flow=0x100e99280, error=0x0) at drivers/net/tap/tap_flow.c:1514 (gdb) p remote_flow $1 = (struct rte_flow *) 0x6b6b6b6b6b6b6b6b Which is here: static int tap_flow_destroy_pmd(struct pmd_internals *pmd, struct rte_flow *flow, struct rte_flow_error *error) { struct rte_flow *remote_flow = flow->remote_flow; ... if (remote_flow) { remote_flow->msg.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; Simplest fix is to use rte_zmalloc() so remote_flow and other fields are always set at zero. Fixes: 2bc06869cd94 ("net/tap: add remote netdevice traffic capture") Signed-off-by: Stephen Hemminger Reviewed-by: Ferruh Yigit --- drivers/net/tap/tap_flow.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/tap/tap_flow.c b/drivers/net/tap/tap_flow.c index 9d90361d99..1538349e9c 100644 --- a/drivers/net/tap/tap_flow.c +++ b/drivers/net/tap/tap_flow.c @@ -1380,7 +1380,7 @@ tap_flow_create(struct rte_eth_dev *dev, NULL, "priority value too big"); goto fail; } - flow = rte_malloc(__func__, sizeof(struct rte_flow), 0); + flow = rte_zmalloc(__func__, sizeof(struct rte_flow), 0); if (!flow) { rte_flow_error_set(error, ENOMEM, RTE_FLOW_ERROR_TYPE_HANDLE, NULL, "cannot allocate memory for rte_flow"); @@ -1416,7 +1416,7 @@ tap_flow_create(struct rte_eth_dev *dev, * to the local pmd->if_index. */ if (pmd->remote_if_index) { - remote_flow = rte_malloc(__func__, sizeof(struct rte_flow), 0); + remote_flow = rte_zmalloc(__func__, sizeof(struct rte_flow), 0); if (!remote_flow) { rte_flow_error_set( error, ENOMEM, RTE_FLOW_ERROR_TYPE_HANDLE, NULL, @@ -1693,7 +1693,7 @@ int tap_flow_implicit_create(struct pmd_internals *pmd, } }; - remote_flow = rte_malloc(__func__, sizeof(struct rte_flow), 0); + remote_flow = rte_zmalloc(__func__, sizeof(struct rte_flow), 0); if (!remote_flow) { TAP_LOG(ERR, "Cannot allocate memory for rte_flow"); goto fail; @@ -1896,7 +1896,7 @@ static int rss_enable(struct pmd_internals *pmd, return -ENOTSUP; } - rss_flow = rte_malloc(__func__, sizeof(struct rte_flow), 0); + rss_flow = rte_zmalloc(__func__, sizeof(struct rte_flow), 0); if (!rss_flow) { TAP_LOG(ERR, "Cannot allocate memory for rte_flow"); -- 2.20.1 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2020-05-19 14:04:52.397843905 +0100 +++ 0192-net-tap-fix-crash-in-flow-destroy.patch 2020-05-19 14:04:44.544654318 +0100 @@ -1,8 +1,10 @@ -From 8451387df206f5ad34461280ab6a2e5bfe382b9b Mon Sep 17 00:00:00 2001 +From 2befb2f470b5141bead91c26d1220304b0667385 Mon Sep 17 00:00:00 2001 From: Stephen Hemminger Date: Mon, 27 Apr 2020 14:39:26 -0700 Subject: [PATCH] net/tap: fix crash in flow destroy +[ upstream commit 8451387df206f5ad34461280ab6a2e5bfe382b9b ] + The TAP driver does not initialize all the elements of the rte_flow structure. This can lead to crash in rte_flow_destroy. @@ -28,7 +30,6 @@ are always set at zero. Fixes: 2bc06869cd94 ("net/tap: add remote netdevice traffic capture") -Cc: stable@dpdk.org Signed-off-by: Stephen Hemminger Reviewed-by: Ferruh Yigit