From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 1EC8CA034F for ; Wed, 10 Nov 2021 07:55:25 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 182A540142; Wed, 10 Nov 2021 07:55:25 +0100 (CET) Received: from NAM04-BN8-obe.outbound.protection.outlook.com (mail-bn8nam08on2048.outbound.protection.outlook.com [40.107.100.48]) by mails.dpdk.org (Postfix) with ESMTP id A99A340142 for ; Wed, 10 Nov 2021 07:55:23 +0100 (CET) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OyixIs0xtyl3vTBc5AipDRV96bEWV6X+YjtAkEv3YFYNwT9VUgqSa/YDCJzpEDTH6aF12ncI673sIpbTvJRiATVK0qTwRqpecJTYrakkGOSbzXpn+ZEfkBQX+ibGaea6xwZpF/wq1TNkkwPdmA6b3iIrrKgDn7uyQ/0k+IfE0W8rxC3YIzlK/+Vemb0bT5v3cs+ap8XjM6T184I3qfqK1FQevjE6EKzYZM8b/VnPzwxwmw3xlvL8dR/IauxXXrUWG8Fna66455t8ykiGPb79CrO9mwd5DXK/tKlkiy4r/j5cR/z47+lL4Y25j6xKe9iQEodkTinpy5QA+uFOlRXLSw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=b/UIhhGfE+lmZU5stHPBtGEWlZC26HMahRPKUrGTE9Y=; b=FBix1NiOFvb7lgwoaN9Kmq5pP/0qSPcVAWwvl7E1TAlr9wyZxgJ67egOhMRNqigbu4vJ2lMBmND3XXHgrLiUxMekEKUW9DvAYvw5woQMGGOIP0Dg08udfh2kB4vgpu1M/tCajOsVzlmZDkF76AxgzQLTuSKCt6sgccsiDZr0kgHR4Oku95L8KwlTRRYph0nps1d4+EKcvZI7jaUKScAl+OdXFgOpDsSukYUyIRJWsYTOUdDWozKytlaZhfdLVzA25jnRG/MNc0OicyNXO+jHryegx62gN442cWmaVT87nEF7smR23tECnKowmZaocgjGAHFOeNcJQ8DX2OusTni3iA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.112.34) smtp.rcpttodomain=redhat.com smtp.mailfrom=nvidia.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=b/UIhhGfE+lmZU5stHPBtGEWlZC26HMahRPKUrGTE9Y=; b=Ko9LXTX8tsBvqogjJdBwxMIZRekieXJrIQs3H8KE0P0QOiz4leSGDzzfGSYycJIqn8B4n1UNbz6ZWW2ZFylDgzglQTgjT1LtQft+7iw1Fdxg7qgzJWACK+fKzojYmWTJ/5uoUOu3IVoe7SiQXFH1hTP/i/KAXZGB/aoarfNjiOvceVJsb23HEFYlvRRNnFwr3x7JPgLIcgFYkKQP6S9sYbmks1+XMEO7mvMqN8l4AfmNxAi0wFcudzC3oTNauPeg+AsqwH7yKgYY16ifjJurpDbkn4/TmJYmKolF+/i6eAoidvDH/rM6PLs+tAUs3dlm4EIGbjcsotH5fHz8NlF+zA== Received: from DM5PR08CA0056.namprd08.prod.outlook.com (2603:10b6:4:60::45) by BY5PR12MB4193.namprd12.prod.outlook.com (2603:10b6:a03:20c::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4690.16; Wed, 10 Nov 2021 06:55:22 +0000 Received: from DM6NAM11FT058.eop-nam11.prod.protection.outlook.com (2603:10b6:4:60:cafe::54) by DM5PR08CA0056.outlook.office365.com (2603:10b6:4:60::45) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4669.11 via Frontend Transport; Wed, 10 Nov 2021 06:55:22 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.112.34) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.112.34 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.112.34; helo=mail.nvidia.com; Received: from mail.nvidia.com (216.228.112.34) by DM6NAM11FT058.mail.protection.outlook.com (10.13.172.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.4690.15 via Frontend Transport; Wed, 10 Nov 2021 06:55:21 +0000 Received: from nvidia.com (172.20.187.6) by HQMAIL107.nvidia.com (172.20.187.13) with Microsoft SMTP Server (TLS) id 15.0.1497.18; Wed, 10 Nov 2021 06:55:19 +0000 From: Xueming Li To: Olivier Matz CC: Luca Boccassi , David Marchand , dpdk stable Date: Wed, 10 Nov 2021 14:31:29 +0800 Message-ID: <20211110063216.2744012-206-xuemingl@nvidia.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20211110063216.2744012-1-xuemingl@nvidia.com> References: <20211110063216.2744012-1-xuemingl@nvidia.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [172.20.187.6] X-ClientProxiedBy: HQMAIL101.nvidia.com (172.20.187.10) To HQMAIL107.nvidia.com (172.20.187.13) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 33b20e0b-519e-4072-82e2-08d9a4171070 X-MS-TrafficTypeDiagnostic: BY5PR12MB4193: X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:5236; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: uXKb9YNhStYCTk+lMviDjle4HwWd6xnlJh8lnHhAQg5qThQAq5npq5qhAah6mU6tRPR3LAFRWEDB2DfU3VefTrgPSLm517jOGIWViIR9pa0dKvnoDmfOlg2S3qNunwTYmED3NQY+qsapVUDVrdS5MXXtCk/m/RYjyfB4e+7594bKuTkn+J68xDDD1o20N3MeI03Cvu5dx4VFIblvlC60mSUgPTafvJ0LlsLEEjdbPf9NrPO6V34iCipIbnq2zJVV33ZjICkOWhYFOjImlNEaWOrlvyjcgrqGiVdjNmsC5b4K3IA7+GAj4O9eHspyJlCl6gEloKhuRvSQbyEhowFYtAM1xgod1WXYdcbS0AH6WuIMNOCX7wqk/Dk6m3HOJMsvNCVasITLD5l8gOLI64Hi1NJk45XtyUubbbs/7uXZk57il0kEqF00Bh06RCCCmVoMdYqoXN7JOFva7HaG7DOnyYbbVkm9zSAgYOSM3zz2TtzO3Z393mvVoqRisbUyM3zGf0mDlb+XUPWze7wxnBQXQo44i0mLIh6e6CMuT7W2qt3zyM0Sau1ohYyIgnVo/xHW6mA2i091AM2kz7KVvFITaLiha10bMii59V8iDd5ypsrTH4X/2gF7TsudkSXGsUFnH6zGt7i9emFSX7nODewVFHenZHV2cbybL8AUlJAA4RBeEZurMMt8oh7RWJgaAYKAvzAp1CYojHdoPvodcj+AWIkgLDh5hIRE+yDyvufqa5CtOfWUA9431tIv0wV+RFRZ0DtBGYpYnfHkUxqkVEQOB7Lyo9gqDGsmjXZ3oFOkC382FX89h32wJBHiElIhEpQKm/Q4omK0t800WPZDbyrkmg== X-Forefront-Antispam-Report: CIP:216.228.112.34; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:schybrid03.nvidia.com; CAT:NONE; SFS:(4636009)(36840700001)(46966006)(70586007)(36756003)(36860700001)(70206006)(966005)(86362001)(508600001)(83380400001)(6666004)(6286002)(55016002)(7636003)(82310400003)(1076003)(356005)(6916009)(53546011)(7696005)(4001150100001)(186003)(16526019)(26005)(54906003)(47076005)(316002)(2616005)(8936002)(8676002)(5660300002)(4326008)(2906002)(336012)(426003); DIR:OUT; SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Nov 2021 06:55:21.5598 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 33b20e0b-519e-4072-82e2-08d9a4171070 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[216.228.112.34]; Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT058.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR12MB4193 Subject: [dpdk-stable] patch 'test/mbuf: fix access to freed memory' has been queued to stable release 20.11.4 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" Hi, FYI, your patch has been queued to stable release 20.11.4 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 11/12/21. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://github.com/steevenlee/dpdk This queued commit can be viewed at: https://github.com/steevenlee/dpdk/commit/91ec527f27d1988bc88678ca37e16e7f5b988799 Thanks. Xueming Li --- >From 91ec527f27d1988bc88678ca37e16e7f5b988799 Mon Sep 17 00:00:00 2001 From: Olivier Matz Date: Fri, 29 Oct 2021 14:15:44 +0200 Subject: [PATCH] test/mbuf: fix access to freed memory Cc: Xueming Li [ upstream commit 7dc627426e534c3b04e4f872343e1899df26471e ] Seen by ASan. In the external buffer mbuf test, we check that the buffer is freed by checking that its refcount is 0. This is not a valid condition, because it accesses to an already freed area. Fix this by setting a boolean flag in the callback when rte_free() is actually called, and check this flag instead. Bugzilla ID: 867 Fixes: 7b295dceea07 ("test/mbuf: add unit test cases") Reported-by: David Marchand Signed-off-by: Olivier Matz Reviewed-by: David Marchand --- app/test/test_mbuf.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/app/test/test_mbuf.c b/app/test/test_mbuf.c index 69a361c2f5..a6c11dd5b1 100644 --- a/app/test/test_mbuf.c +++ b/app/test/test_mbuf.c @@ -2305,16 +2305,16 @@ fail: /* Define a free call back function to be used for external buffer */ static void -ext_buf_free_callback_fn(void *addr __rte_unused, void *opaque) +ext_buf_free_callback_fn(void *addr, void *opaque) { - void *ext_buf_addr = opaque; + bool *freed = opaque; - if (ext_buf_addr == NULL) { + if (addr == NULL) { printf("External buffer address is invalid\n"); return; } - rte_free(ext_buf_addr); - ext_buf_addr = NULL; + rte_free(addr); + *freed = true; printf("External buffer freed via callback\n"); } @@ -2338,6 +2338,7 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool) void *ext_buf_addr = NULL; uint16_t buf_len = EXT_BUF_TEST_DATA_LEN + sizeof(struct rte_mbuf_ext_shared_info); + bool freed = false; /* alloc a mbuf */ m = rte_pktmbuf_alloc(pktmbuf_pool); @@ -2353,7 +2354,7 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool) GOTO_FAIL("%s: External buffer allocation failed\n", __func__); ret_shinfo = rte_pktmbuf_ext_shinfo_init_helper(ext_buf_addr, &buf_len, - ext_buf_free_callback_fn, ext_buf_addr); + ext_buf_free_callback_fn, &freed); if (ret_shinfo == NULL) GOTO_FAIL("%s: Shared info initialization failed!\n", __func__); @@ -2386,26 +2387,35 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool) if (rte_mbuf_ext_refcnt_read(ret_shinfo) != 2) GOTO_FAIL("%s: Invalid ext_buf ref_cnt\n", __func__); + if (freed) + GOTO_FAIL("%s: extbuf should not be freed\n", __func__); /* test to manually update ext_buf_ref_cnt from 2 to 3*/ rte_mbuf_ext_refcnt_update(ret_shinfo, 1); if (rte_mbuf_ext_refcnt_read(ret_shinfo) != 3) GOTO_FAIL("%s: Update ext_buf ref_cnt failed\n", __func__); + if (freed) + GOTO_FAIL("%s: extbuf should not be freed\n", __func__); /* reset the ext_refcnt before freeing the external buffer */ rte_mbuf_ext_refcnt_set(ret_shinfo, 2); if (rte_mbuf_ext_refcnt_read(ret_shinfo) != 2) GOTO_FAIL("%s: set ext_buf ref_cnt failed\n", __func__); + if (freed) + GOTO_FAIL("%s: extbuf should not be freed\n", __func__); /* detach the external buffer from mbufs */ rte_pktmbuf_detach_extbuf(m); /* check if ref cnt is decremented */ if (rte_mbuf_ext_refcnt_read(ret_shinfo) != 1) GOTO_FAIL("%s: Invalid ext_buf ref_cnt\n", __func__); + if (freed) + GOTO_FAIL("%s: extbuf should not be freed\n", __func__); rte_pktmbuf_detach_extbuf(clone); - if (rte_mbuf_ext_refcnt_read(ret_shinfo) != 0) - GOTO_FAIL("%s: Invalid ext_buf ref_cnt\n", __func__); + if (!freed) + GOTO_FAIL("%s: extbuf should be freed\n", __func__); + freed = false; rte_pktmbuf_free(m); m = NULL; -- 2.33.0 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2021-11-10 14:17:10.980846666 +0800 +++ 0205-test-mbuf-fix-access-to-freed-memory.patch 2021-11-10 14:17:02.014078251 +0800 @@ -1 +1 @@ -From 7dc627426e534c3b04e4f872343e1899df26471e Mon Sep 17 00:00:00 2001 +From 91ec527f27d1988bc88678ca37e16e7f5b988799 Mon Sep 17 00:00:00 2001 @@ -4,0 +5,3 @@ +Cc: Xueming Li + +[ upstream commit 7dc627426e534c3b04e4f872343e1899df26471e ] @@ -18 +20,0 @@ -Cc: stable@dpdk.org @@ -28 +30 @@ -index 94d1cdde37..f93bcef8a9 100644 +index 69a361c2f5..a6c11dd5b1 100644 @@ -31 +33 @@ -@@ -2307,16 +2307,16 @@ fail: +@@ -2305,16 +2305,16 @@ fail: @@ -53 +55 @@ -@@ -2340,6 +2340,7 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool) +@@ -2338,6 +2338,7 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool) @@ -61 +63 @@ -@@ -2355,7 +2356,7 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool) +@@ -2353,7 +2354,7 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool) @@ -70 +72 @@ -@@ -2388,26 +2389,35 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool) +@@ -2386,26 +2387,35 @@ test_pktmbuf_ext_shinfo_init_helper(struct rte_mempool *pktmbuf_pool)