[PATCH 19.11] app/testpmd: fix packet burst spreading stats

[PATCH 19.11] app/testpmd: fix packet burst spreading stats

[Eli Britstein]

[ upstream commit 6a8b64fd5e9e8f5572ea4d9de40a1cff23498246 ]

RX/TX functions (rte_eth_rx_burst/rte_eth_tx_burst) get 'nb_pkts'
argument, which specifies the maximum number to receive/transmit.
It can be 0..nb_pkts, meaning nb_pkts+1 options.
Testpmd can provide statistics of the burst sizes ('set
record-burst-stats on') by incrementing an array cell of index
<burst-size>. This array is mistakenly [MAX_PKT_BURST] size. Receiving
the maximum burst will cause out of bound write.
Enlarge the spread stats array by one cell to fix it.

Fixes: af75078fece3 ("first public release")

Signed-off-by: Eli Britstein <elibr@nvidia.com>
Reviewed-by: Matan Azrad <matan@nvidia.com>
Acked-by: Ferruh Yigit <ferruh.yigit@intel.com>
---
 app/test-pmd/testpmd.c | 2 +-
 app/test-pmd/testpmd.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c
index bd15fe9e53..f4a54102ca 100644
--- a/app/test-pmd/testpmd.c
+++ b/app/test-pmd/testpmd.c
@@ -1605,7 +1605,7 @@ pkt_burst_stats_display(const char *rx_tx, struct pkt_burst_stats *pbs)
 	total_burst = 0;
 	burst_stats[0] = burst_stats[1] = burst_stats[2] = 0;
 	pktnb_stats[0] = pktnb_stats[1] = pktnb_stats[2] = 0;
-	for (nb_pkt = 0; nb_pkt < MAX_PKT_BURST; nb_pkt++) {
+	for (nb_pkt = 0; nb_pkt < MAX_PKT_BURST + 1; nb_pkt++) {
 		nb_burst = pbs->pkt_burst_spread[nb_pkt];
 		if (nb_burst == 0)
 			continue;
diff --git a/app/test-pmd/testpmd.h b/app/test-pmd/testpmd.h
index bbe18a7191..334bcc28e6 100644
--- a/app/test-pmd/testpmd.h
+++ b/app/test-pmd/testpmd.h
@@ -86,7 +86,7 @@ enum {
  * that are recorded for each forwarding stream.
  */
 struct pkt_burst_stats {
-	unsigned int pkt_burst_spread[MAX_PKT_BURST];
+	unsigned int pkt_burst_spread[MAX_PKT_BURST + 1];
 };
 #endif
 
-- 
2.28.0.2311.g225365fb51

Re: [PATCH 19.11] app/testpmd: fix packet burst spreading stats

[Christian Ehrhardt]

On Wed, Dec 1, 2021 at 8:26 AM Eli Britstein <elibr@nvidia.com> wrote:
>
> [ upstream commit 6a8b64fd5e9e8f5572ea4d9de40a1cff23498246 ]
>

Thanks, applied

> RX/TX functions (rte_eth_rx_burst/rte_eth_tx_burst) get 'nb_pkts'
> argument, which specifies the maximum number to receive/transmit.
> It can be 0..nb_pkts, meaning nb_pkts+1 options.
> Testpmd can provide statistics of the burst sizes ('set
> record-burst-stats on') by incrementing an array cell of index
> <burst-size>. This array is mistakenly [MAX_PKT_BURST] size. Receiving
> the maximum burst will cause out of bound write.
> Enlarge the spread stats array by one cell to fix it.
>
> Fixes: af75078fece3 ("first public release")
>
> Signed-off-by: Eli Britstein <elibr@nvidia.com>
> Reviewed-by: Matan Azrad <matan@nvidia.com>
> Acked-by: Ferruh Yigit <ferruh.yigit@intel.com>
> ---
>  app/test-pmd/testpmd.c | 2 +-
>  app/test-pmd/testpmd.h | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c
> index bd15fe9e53..f4a54102ca 100644
> --- a/app/test-pmd/testpmd.c
> +++ b/app/test-pmd/testpmd.c
> @@ -1605,7 +1605,7 @@ pkt_burst_stats_display(const char *rx_tx, struct pkt_burst_stats *pbs)
>         total_burst = 0;
>         burst_stats[0] = burst_stats[1] = burst_stats[2] = 0;
>         pktnb_stats[0] = pktnb_stats[1] = pktnb_stats[2] = 0;
> -       for (nb_pkt = 0; nb_pkt < MAX_PKT_BURST; nb_pkt++) {
> +       for (nb_pkt = 0; nb_pkt < MAX_PKT_BURST + 1; nb_pkt++) {
>                 nb_burst = pbs->pkt_burst_spread[nb_pkt];
>                 if (nb_burst == 0)
>                         continue;
> diff --git a/app/test-pmd/testpmd.h b/app/test-pmd/testpmd.h
> index bbe18a7191..334bcc28e6 100644
> --- a/app/test-pmd/testpmd.h
> +++ b/app/test-pmd/testpmd.h
> @@ -86,7 +86,7 @@ enum {
>   * that are recorded for each forwarding stream.
>   */
>  struct pkt_burst_stats {
> -       unsigned int pkt_burst_spread[MAX_PKT_BURST];
> +       unsigned int pkt_burst_spread[MAX_PKT_BURST + 1];
>  };
>  #endif
>
> --
> 2.28.0.2311.g225365fb51
>


-- 
Christian Ehrhardt
Staff Engineer, Ubuntu Server
Canonical Ltd