From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id D49F446A63 for ; Thu, 26 Jun 2025 14:05:08 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id CDF01402A3; Thu, 26 Jun 2025 14:05:08 +0200 (CEST) Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2065.outbound.protection.outlook.com [40.107.93.65]) by mails.dpdk.org (Postfix) with ESMTP id 6701B400D6 for ; Thu, 26 Jun 2025 14:05:07 +0200 (CEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=G1cYtLUv4ovNaDroJEG+uvM3z23TWZWRDCs4LPTKSwJlFm2FydHRS585Dmu4Aq0VPmu+VTiM9zhylCTydC+WQEOMA9+55aZAykbS7qU5rYBLpTfEB6ofydJu6oJsAIMelDBqW468zYTlrLqKg/IvHj64HOqxRflThAYaj+io9WP2h8Tt+6/WScahPtc2oXCicdHvVfTRlBuEvDjxUS2UX+YmlYcF0SkE+LJPCI1f8owQFdiWludEcBBU2/uV/YDQfNJFwspGHnKfPtZ8LwfNy1qQp8BU5fcLDw5Dwr6hgwrQJfrA3OGcSxhgzPk4mLypJ3/JuF5bUIlIGpkc0NchCA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=/XvxzSW5KEakll54tOwhFYuu9oES6aLhaIJn+bQPVUs=; b=rU2r+XkxPjbtmcHncQugCu0A/okjt+1m3crJa8rNLdiiU10cMEu0hSaULkV+qKsz+nllzMeTnNdf2QqoHGKQtgIfifcq+LjHisLurVHQaNLkh+bUifjrQwwmAingCk38ijeJMjKFyBoVcBslQrooFeJaZNZtUroCa7SSn77cx4Ex+1lv5FLO9F9fG1TqW41T5XzRSVHXnNt24mjNXk5/4b8IwJMLn8U3xiRCY57dM3GFkN/SWQhsbM911iL5UG7FEAPuX1yk9O+xGOBnkQkaT3KRa/bRz1Eo2qxjgxxVhppszXKZcYl6i+NziBblMWr58uVEKZtjJtnOdCHy3F/hxA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=6wind.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=/XvxzSW5KEakll54tOwhFYuu9oES6aLhaIJn+bQPVUs=; b=HKWIKWnUDQ+f0IqawKALtEkXNwhd0PDWbfvS7i9x3n3YKaTW8VolOIBOlQEKEDIBApa9OlN7jKCVFVE79Jzf3ORltBIIYRzfrOBGdy1ZSwPUr+Xvay9PS6gFqmT0ZABq730om6e0yv5td4ZelxVs+YbJ+RUnA4gUYHQHdLqxXNLX5Xp6B1JBViO65JBurgQO6FQb0E6pOUZMFwnd9vZAkqivxd0gZvPjXe7xy9zjGUkULyC1JDsdEDUEfpRl4W7BEbwTwk17HzGBQ3fcMyppVzuLfpUPvF8JPVDonGzWqKaDWXXTHTGJdb5/iJ32E2Aqm6RypHRo7e4zgWxIY+pOnA== Received: from MN2PR08CA0016.namprd08.prod.outlook.com (2603:10b6:208:239::21) by IA0PR12MB7676.namprd12.prod.outlook.com (2603:10b6:208:432::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8880.16; Thu, 26 Jun 2025 12:05:02 +0000 Received: from MN1PEPF0000F0E4.namprd04.prod.outlook.com (2603:10b6:208:239:cafe::1e) by MN2PR08CA0016.outlook.office365.com (2603:10b6:208:239::21) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8880.17 via Frontend Transport; Thu, 26 Jun 2025 12:05:02 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by MN1PEPF0000F0E4.mail.protection.outlook.com (10.167.242.42) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8880.14 via Frontend Transport; Thu, 26 Jun 2025 12:05:02 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Thu, 26 Jun 2025 05:04:47 -0700 Received: from nvidia.com (10.126.230.35) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Thu, 26 Jun 2025 05:04:45 -0700 From: Xueming Li To: Ariel Otilibili CC: Xueming Li , Stephen Hemminger , dpdk stable Subject: patch 'net/af_xdp: fix use after free in zero-copy Tx' has been queued to stable release 23.11.5 Date: Thu, 26 Jun 2025 20:00:53 +0800 Message-ID: <20250626120145.27369-34-xuemingl@nvidia.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250626120145.27369-1-xuemingl@nvidia.com> References: <20250626120145.27369-1-xuemingl@nvidia.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.126.230.35] X-ClientProxiedBy: rnnvmail201.nvidia.com (10.129.68.8) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MN1PEPF0000F0E4:EE_|IA0PR12MB7676:EE_ X-MS-Office365-Filtering-Correlation-Id: f84c9f90-b065-433e-b7d2-08ddb4a9ae85 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|82310400026|376014|36860700013|1800799024|7053199007; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?w8HgtEvZUIcc/AnBrjkA2Jm5x0U0rmVcnSDgr6IE8lu5y57jGNs5HNJWmryB?= =?us-ascii?Q?9em4p6+0OtiA+WNUzoFW4pnB0A6V7y9qaA6sg2bouoM+5azJYgMIqCFiu3b/?= =?us-ascii?Q?jQSenL8BbOw8HHRvIzTYCRq5aMQidj0NreLSyNrBnQB7BKEQS48tg+WIlklE?= =?us-ascii?Q?GdYzU8Ix6lLOTnFdaLdrg4GqzOPRGvmjr+XE2OlcVP/A69rDhsSEi0fvuCom?= =?us-ascii?Q?D7IOaTouwC+pF7w/plr2bjWAXG0KjDFqI1XRiUETfW60M+6/NgwJe9hvROMP?= =?us-ascii?Q?RBmQYyKj2/T45Utyuvo0/eKXyj8OU/RnfrKZ+jUlgK9nnrH+yrrfpaRNSVh6?= =?us-ascii?Q?d33JXhawJwOeSBYMSZp6Ed9fTl1Q5xsemPcisiPRPkPKtLRVuCpzXbAGBy25?= =?us-ascii?Q?c8JRUOIfsFXGaKeHqk6L2wVH1Xup3hyZfzL+f4h5AJpm/2ZGySDuyKUhCiuD?= =?us-ascii?Q?/jp9DQhjmyz58+ANynw2iFwAVYh+giS9tZmzSRRwVrmbxFqUcZJJ2Z8DYB04?= =?us-ascii?Q?AqEmJofih03Z+qtxVRA/7ddEswkbB+HUoxDePzNELXEIuri6TDQ1msi4Nz1v?= =?us-ascii?Q?POAgvEeg/jU6wF9bj1St77k6gaozGgtTTC/1x3r3J66brFS9kvOPVkP6iKH3?= =?us-ascii?Q?iW7oJvedRk18kICCL1eIRcbyRqu9IGqHgywBB0Pw3kmE+4uPiO07QUfl3sFd?= =?us-ascii?Q?cYaq/8nXp9PVBKw0waRndxSaXjMOo3UGhlVB/e7yQFp9FOP6kzQDQKRHuaLl?= =?us-ascii?Q?u2EAMvN2MVu1C9MVTJkPhfX1m+z54hqo747eNrVH8wjgZZm5/7myIJgMSNWb?= =?us-ascii?Q?GE5/SQTKR8q6Qxd1J3/rZ8KWwsrOE477H2pml9rgkzDUd++kISlmuAKmFKTd?= =?us-ascii?Q?MleNKlvk688ATKixVxDtuH0IzTHqPdV2HhMpjgSINNkRyPNr81jnE4c3F/3T?= =?us-ascii?Q?4o4R/GGL+Q7stni9H1m5oI4yhYQoL+SecZA/z8Rde8/AHRmW5asCaoF5oTNg?= =?us-ascii?Q?HLTzLAKaM28IhOEejNxVFR083DHE+kB+rrCINcnja6Vb8/gdOMJiJd7tlw4H?= =?us-ascii?Q?gBw+5ZykEDWuQJa5iO9c/Fet281T3a6CbWOmRFYBfs6zT7uHT6Ut+j38KlC1?= =?us-ascii?Q?pFvCt+zVRsrjSyu0bIAi4cIgXmOnVVj8yjqBlbKCbnOBJESfmpI2Xz1t04g+?= =?us-ascii?Q?2TsDdxOXgu/8pdtqopLlxfzvEBNGZpWLIvDwsLDB343dNr9zgKgivAaIT7WP?= =?us-ascii?Q?3osoj4qXN/di6VvHEvToanXukBCoxbEFfEo2uAB8IUMovTcyzpVJ9t+CbSqe?= =?us-ascii?Q?hFiH41HieAiGGRUI5teuCWKOuV8G1LuFWh+g9l7cgyEGOiQWobpkllLVoBMC?= =?us-ascii?Q?CYV5j+1UujysjAgD1Dzs/etMhEaDLjJ5yUhOQOc4x4LnR4h6S1c8zDMlA8ro?= =?us-ascii?Q?vAGzt2TCVaN9aO5fcYIZBkQr7O5TnOvFkiOGbvCCNvbnTDrl28KTq7b2zpmK?= =?us-ascii?Q?SB5TBMiOItYiMw++cz4JiYr2H8q1cCNbAT/1wTyCzLl8otE9xyMhmaiM7w?= =?us-ascii?Q?=3D=3D?= X-Forefront-Antispam-Report: CIP:216.228.117.160; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:dc6edge1.nvidia.com; CAT:NONE; SFS:(13230040)(82310400026)(376014)(36860700013)(1800799024)(7053199007); DIR:OUT; SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jun 2025 12:05:02.5028 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: f84c9f90-b065-433e-b7d2-08ddb4a9ae85 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[216.228.117.160]; Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MN1PEPF0000F0E4.namprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR12MB7676 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Hi, FYI, your patch has been queued to stable release 23.11.5 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 06/28/25. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://git.dpdk.org/dpdk-stable/log/?h=23.11-staging This queued commit can be viewed at: https://git.dpdk.org/dpdk-stable/commit/?h=23.11-staging&id=c8e1da2dc3c718f37d5609ef1b01bf8d2be6a339 Thanks. Xueming Li --- >From c8e1da2dc3c718f37d5609ef1b01bf8d2be6a339 Mon Sep 17 00:00:00 2001 From: Ariel Otilibili Date: Wed, 26 Feb 2025 21:08:40 +0100 Subject: [PATCH] net/af_xdp: fix use after free in zero-copy Tx Cc: Xueming Li [ upstream commit a23bf7fde78b10afbbafda252f15495b26e010a9 ] tx_bytes is computed after both legs are tested. This might produce a use after memory free. The computation is now moved into each leg. Bugzilla ID: 1440 Fixes: d8a210774e1d ("net/af_xdp: support unaligned umem chunks") Signed-off-by: Ariel Otilibili Acked-by: Stephen Hemminger --- drivers/net/af_xdp/rte_eth_af_xdp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/af_xdp/rte_eth_af_xdp.c b/drivers/net/af_xdp/rte_eth_af_xdp.c index 74f750dbb3..668b184b94 100644 --- a/drivers/net/af_xdp/rte_eth_af_xdp.c +++ b/drivers/net/af_xdp/rte_eth_af_xdp.c @@ -570,6 +570,7 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) umem->mb_pool->header_size; offset = offset << XSK_UNALIGNED_BUF_OFFSET_SHIFT; desc->addr = addr | offset; + tx_bytes += desc->len; count++; } else { struct rte_mbuf *local_mbuf = @@ -597,11 +598,10 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) desc->addr = addr | offset; rte_memcpy(pkt, rte_pktmbuf_mtod(mbuf, void *), desc->len); + tx_bytes += desc->len; rte_pktmbuf_free(mbuf); count++; } - - tx_bytes += mbuf->pkt_len; } out: -- 2.34.1 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2025-06-26 19:59:19.218817167 +0800 +++ 0033-net-af_xdp-fix-use-after-free-in-zero-copy-Tx.patch 2025-06-26 19:59:17.338418046 +0800 @@ -1 +1 @@ -From a23bf7fde78b10afbbafda252f15495b26e010a9 Mon Sep 17 00:00:00 2001 +From c8e1da2dc3c718f37d5609ef1b01bf8d2be6a339 Mon Sep 17 00:00:00 2001 @@ -4,0 +5,3 @@ +Cc: Xueming Li + +[ upstream commit a23bf7fde78b10afbbafda252f15495b26e010a9 ] @@ -13 +15,0 @@ -Cc: stable@dpdk.org @@ -18 +19,0 @@ - .mailmap | 2 +- @@ -20 +21 @@ - 2 files changed, 3 insertions(+), 3 deletions(-) + 1 file changed, 2 insertions(+), 2 deletions(-) @@ -22,13 +22,0 @@ -diff --git a/.mailmap b/.mailmap -index 4b781bd3fb..822936f615 100644 ---- a/.mailmap -+++ b/.mailmap -@@ -135,7 +135,7 @@ Anupam Kapoor - Apeksha Gupta - Archana Muniganti - Archit Pandey --Ariel Otilibili -+Ariel Otilibili - Arkadiusz Kubalewski - Arkadiusz Kusztal - Arnaud Fiorini @@ -36 +24 @@ -index 814398ba4b..092bcb73aa 100644 +index 74f750dbb3..668b184b94 100644 @@ -39 +27 @@ -@@ -574,6 +574,7 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) +@@ -570,6 +570,7 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) @@ -47 +35 @@ -@@ -601,11 +602,10 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) +@@ -597,11 +598,10 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)