From: "Dumitrescu, Cristian" <cristian.dumitrescu@intel.com>
To: Robert Sanford <rsanford2@gmail.com>, "dev@dpdk.org" <dev@dpdk.org>
Subject: Re: [dpdk-dev] [PATCH 2/4] port: fix ring writer buffer overflow
Date: Thu, 31 Mar 2016 11:21:15 +0000 [thread overview]
Message-ID: <3EB4FA525960D640B5BDFFD6A3D8912647974D9C@IRSMSX108.ger.corp.intel.com> (raw)
In-Reply-To: <1459198297-49854-3-git-send-email-rsanford@akamai.com>
> -----Original Message-----
> From: Robert Sanford [mailto:rsanford2@gmail.com]
> Sent: Monday, March 28, 2016 9:52 PM
> To: dev@dpdk.org; Dumitrescu, Cristian <cristian.dumitrescu@intel.com>
> Subject: [PATCH 2/4] port: fix ring writer buffer overflow
>
> Ring writer tx_bulk functions may write past the end of tx_buf[].
> Solution is to double the size of tx_buf[].
>
> Signed-off-by: Robert Sanford <rsanford@akamai.com>
> ---
> lib/librte_port/rte_port_ring.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/lib/librte_port/rte_port_ring.c b/lib/librte_port/rte_port_ring.c
> index b847fea..765ecc5 100644
> --- a/lib/librte_port/rte_port_ring.c
> +++ b/lib/librte_port/rte_port_ring.c
> @@ -179,7 +179,7 @@ rte_port_ring_reader_stats_read(void *port,
> struct rte_port_ring_writer {
> struct rte_port_out_stats stats;
>
> - struct rte_mbuf *tx_buf[RTE_PORT_IN_BURST_SIZE_MAX];
> + struct rte_mbuf *tx_buf[2 * RTE_PORT_IN_BURST_SIZE_MAX];
> struct rte_ring *ring;
> uint32_t tx_burst_sz;
> uint32_t tx_buf_count;
> @@ -447,7 +447,7 @@ rte_port_ring_writer_stats_read(void *port,
> struct rte_port_ring_writer_nodrop {
> struct rte_port_out_stats stats;
>
> - struct rte_mbuf *tx_buf[RTE_PORT_IN_BURST_SIZE_MAX];
> + struct rte_mbuf *tx_buf[2 * RTE_PORT_IN_BURST_SIZE_MAX];
> struct rte_ring *ring;
> uint32_t tx_burst_sz;
> uint32_t tx_buf_count;
> --
> 1.7.1
Hi Robert,
How is the buffer overflow taking place?
After looking long and hard, I spotted that buffer overflow can potentially take place when the following conditions are met:
1. The input packet burst does not meet the conditions of (a) being contiguous (first n bits set in pkts_mask, all the other bits cleared) and (b) containing a full burst, i.e. at least tx_burst_sz packets (n >= tx_burst_size). This is the slow(er) code path taken when local variable expr != 0.
2. There are some packets already in the buffer.
3. The number of packets in the incoming burst (i.e. popcount(pkts_mask)) plus the number of packets already in the buffer exceeds the buffer size (RTE_PORT_IN_BURST_SIZE_MAX, i.e. 64).
Is this the buffer overflow scenario that you detected?
Thanks,
Cristian
next prev parent reply other threads:[~2016-03-31 11:21 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-28 20:51 [dpdk-dev] [PATCH 0/4] port: fix and test bugs in tx_bulk ops Robert Sanford
2016-03-28 20:51 ` [dpdk-dev] [PATCH 1/4] app/test: enhance test_port_ring_writer Robert Sanford
2016-04-01 19:42 ` Sanford, Robert
2016-04-06 16:46 ` Dumitrescu, Cristian
2016-03-28 20:51 ` [dpdk-dev] [PATCH 2/4] port: fix ring writer buffer overflow Robert Sanford
2016-03-31 11:21 ` Dumitrescu, Cristian [this message]
2016-03-28 20:51 ` [dpdk-dev] [PATCH 3/4] port: fix full burst checks in f_tx_bulk ops Robert Sanford
2016-03-31 15:41 ` Dumitrescu, Cristian
2016-04-01 19:31 ` Sanford, Robert
2016-03-28 20:51 ` [dpdk-dev] [PATCH 4/4] port: fix ethdev writer burst too big Robert Sanford
2016-03-31 13:22 ` Dumitrescu, Cristian
2016-03-30 11:00 ` [dpdk-dev] [PATCH 0/4] port: fix and test bugs in tx_bulk ops Thomas Monjalon
2016-03-30 11:58 ` Dumitrescu, Cristian
2016-04-01 14:58 [dpdk-dev] [PATCH 2/4] port: fix ring writer buffer overflow Sanford, Robert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3EB4FA525960D640B5BDFFD6A3D8912647974D9C@IRSMSX108.ger.corp.intel.com \
--to=cristian.dumitrescu@intel.com \
--cc=dev@dpdk.org \
--cc=rsanford2@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).