From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 2FCA4A034F for ; Mon, 11 Oct 2021 13:04:07 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 22B544003C; Mon, 11 Oct 2021 13:04:07 +0200 (CEST) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [216.205.24.124]) by mails.dpdk.org (Postfix) with ESMTP id AF1534003C for ; Mon, 11 Oct 2021 13:04:05 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1633950245; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=FDkMwcgk87Y75+I2epWGMMlvJBJAMpBSAUOQ+u8HU7s=; b=EpywFBFbpAofiAAgUrHmq+dPoTRblFTsUPbaMWcru+1GvKEbermOq2eiFcipDwep+n67IU m8eTx86FRZm3vva1p7jQA9HP2QIpX6rotgjcQUDyDdWsAKp7CxETZpT5yjr22tl5oHFEXT fh11vw/Ce9owUxJgsVnc91Ovsy23/J4= Received: from mail-lf1-f71.google.com (mail-lf1-f71.google.com [209.85.167.71]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-593-d48E4t4JNMOOed_S1Z-w0Q-1; Mon, 11 Oct 2021 07:03:34 -0400 X-MC-Unique: d48E4t4JNMOOed_S1Z-w0Q-1 Received: by mail-lf1-f71.google.com with SMTP id bq35-20020a056512152300b003fd45087a72so12438903lfb.9 for ; Mon, 11 Oct 2021 04:03:33 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FDkMwcgk87Y75+I2epWGMMlvJBJAMpBSAUOQ+u8HU7s=; b=JqG7A9Ya+E2/1GM2PWyX3tqG1/PGytCq2c6/x7GYAjf2uEjAxjTEDZ7Zx07fBeT6yX yHGsQzfF0d/t4DqP7SVTMMTiRrYXYtkpM2aijotslEQSO/0u+p1Dc27dpgzKhc/nHPR8 tZOKfr1AXXMd8IRwWGedyGIT4lLvV2L+keNizMiyEe7LF7oD4BsSG1l5JijPONB3OqQe rxSNXAHN75WkKNmxmiXTIl4mflJ88exvqyD5ce9LO7aab/gBaj3+pp5f6ZRzXpt0lzpW ZdMnQVq1ay3E7WcviEaJcLATNc1CEwV9bD2HSwiDO4aSpkVJWC/Xwqv5OFcxzyj7lqGa Dr4g== X-Gm-Message-State: AOAM531QV8roZXCvK/6UfcA8qySYbFcrTkFwvOhkL9Jrqhm3KTH1OpQA CWfqXo6cI+nZMI8ZrEbw0WJdC5ws8iGitmPJrjz/VPlVAFzfl1HkWhbgGKwo6zCN438Ou9Nlxlf 8pgHLpTFFQqbDXaM7RARmsVY= X-Received: by 2002:a2e:91d4:: with SMTP id u20mr21805580ljg.81.1633950212315; Mon, 11 Oct 2021 04:03:32 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwbFXmB7OUP3nQSAT37qvFvZttl63j1dJ4v7B5i2ca1J0frHWL0vGjASTAnNH/3nnd81FpYTZR0UuHOmnPtUec= X-Received: by 2002:a2e:91d4:: with SMTP id u20mr21805539ljg.81.1633950211979; Mon, 11 Oct 2021 04:03:31 -0700 (PDT) MIME-Version: 1.0 References: <1633728526-197782-1-git-send-email-vladimir.medvedkin@intel.com> In-Reply-To: <1633728526-197782-1-git-send-email-vladimir.medvedkin@intel.com> From: David Marchand Date: Mon, 11 Oct 2021 13:03:20 +0200 Message-ID: To: Vladimir Medvedkin Cc: dev , "Wang, Yipeng1" , "Gobriel, Sameh" , Bruce Richardson , dpdk stable Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dmarchan@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="UTF-8" Subject: Re: [dpdk-stable] [PATCH] test/hash: fix buffer overflow X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" On Fri, Oct 8, 2021 at 11:28 PM Vladimir Medvedkin wrote: > > This patch fixes buffer overflow reported by ASAN, > please reference https://bugs.dpdk.org/show_bug.cgi?id=818 > > Some tests for the rte_hash table use the rte_jhash_32b() as > the hash function. This hash function interprets the length > argument in units of 4 bytes. > > This patch divides configured key length by 4 in cases when > rte_jhash_32b() is used. > > Bugzilla ID: 818 > Fixes: af75078fece3 ("first public release") > Cc: stable@dpdk.org > With patch applied, ASan reports another issue. Did you test your fix with ASan? >From GHA, with https://patchwork.dpdk.org/project/dpdk/patch/20211002162432.4348-4-david.marchand@redhat.com/ applied: 30/94 DPDK:fast-tests / hash_autotest FAIL 0.87 s (exit status 1) --- command --- DPDK_TEST='hash_autotest' /home/runner/work/dpdk/dpdk/build/app/test/dpdk-test -l 0-1 --file-prefix=hash_autotest --- stdout --- RTE>>hash_autotest --- stderr --- EAL: Detected CPU lcores: 2 EAL: Detected NUMA nodes: 1 EAL: Detected shared linkage of DPDK EAL: WARNING! Base virtual address hint (0x100005000 != 0x7fa4a7cda000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: Multi-process socket /var/run/dpdk/hash_autotest/mp_socket EAL: Selected IOVA mode 'PA' EAL: No available 1048576 kB hugepages reported EAL: VFIO support initialized EAL: WARNING! Base virtual address hint (0x10000b000 != 0x7fa49688f000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x100011000 != 0x7fa49682e000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x100a12000 != 0x7fa094a00000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x100c17000 != 0x7fa49669f000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x101618000 != 0x7f9c94800000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x10181d000 != 0x7fa49663e000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x10221e000 != 0x7f9894600000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x102423000 != 0x7fa49649f000) not respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x102e24000 != 0x7f9494400000) not respected! EAL: This may cause issues with mapping memory into secondary processes APP: HPET is not enabled, using TSC as default timer ================================================================= ==26840==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000372e3e0 at pc 0x0000014b0eb8 bp 0x7fff80e49990 sp 0x7fff80e49988 READ of size 4 at 0x00000372e3e0 thread T0 #0 0x14b0eb7 in __rte_jhash_2hashes /home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:137:9 #1 0x14b0130 in rte_jhash_2hashes /home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:238:2 #2 0x14b0051 in rte_jhash /home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:284:2 #3 0x7fa4a38c7627 in rte_hash_hash /home/runner/work/dpdk/dpdk/build/../lib/hash/rte_cuckoo_hash.c:538:9 #4 0x7fa4a38d6672 in rte_hash_add_key /home/runner/work/dpdk/dpdk/build/../lib/hash/rte_cuckoo_hash.c:1212:46 #5 0x14a06db in test_five_keys /home/runner/work/dpdk/dpdk/build/../app/test/test_hash.c:715:12 #6 0x149deda in test_hash /home/runner/work/dpdk/dpdk/build/../app/test/test_hash.c:2207:6 #7 0x4d61f6 in cmd_autotest_parsed /home/runner/work/dpdk/dpdk/build/../app/test/commands.c:71:10 #8 0x7fa4a44356c5 in cmdline_parse /home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_parse.c:290:3 #9 0x7fa4a442e8d5 in cmdline_valid_buffer /home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:26:8 #10 0x7fa4a443ff07 in rdline_char_in /home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_rdline.c:421:5 #11 0x7fa4a442f03f in cmdline_in /home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:149:9 #12 0x5ac71e in main /home/runner/work/dpdk/dpdk/build/../app/test/test.c:214:8 #13 0x7fa49ca42bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 #14 0x42eaa9 in _start (/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x42eaa9) 0x00000372e3e1 is located 0 bytes to the right of global variable 'keys' defined in '../app/test/test_hash.c:115:24' (0x372e3a0) of size 65 SUMMARY: AddressSanitizer: global-buffer-overflow /home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:137:9 in __rte_jhash_2hashes Shadow bytes around the buggy address: 0x0000806ddc20: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x0000806ddc30: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x0000806ddc40: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x0000806ddc50: f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 0x0000806ddc60: 01 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 =>0x0000806ddc70: f9 f9 f9 f9 00 00 00 00 00 00 00 00[01]f9 f9 f9 0x0000806ddc80: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 0x0000806ddc90: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 0x0000806ddca0: 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9 0x0000806ddcb0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 0x0000806ddcc0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==26840==ABORTING ------- -- David Marchand