DPDK patches and discussions
 help / color / mirror / Atom feed
From: "Przemysław Ołtarzewski" <p.oltarzewski@gmail.com>
To: David Marchand <david.marchand@redhat.com>
Cc: Chas Williams <3chas3@gmail.com>, dev <dev@dpdk.org>
Subject: Re: [dpdk-dev] [Bug 248] Bonding PMD: Invalid array dimension in TX burst for 802.3ad mode with fast queue leads to SEGFAULT
Date: Wed, 10 Apr 2019 13:39:58 +0200	[thread overview]
Message-ID: <CAFJX8XjAp8pMf5gwFrSz_Aw_M9Lw9QmTC3h0Wp7hTOzkZWzwEg@mail.gmail.com> (raw)
Message-ID: <20190410113958.kzao8U2oVZsU8bRGYNrPYKO9fJzhKgXXpwxB3I09IZY@z> (raw)
In-Reply-To: <CAJFAV8y5V9v1dA7Vx3_7ZoqupYvhvD-BtbR1dt5KOsCt5J2S+g@mail.gmail.com>

Hello David,

I can merge these fixes and run our system using patched DPDK version. Then
report back any problems / improvements I observe. I can also walk through
source code changes and check for anything questionable.

Unfortunately I lack deep enough understanding of DPDK source code to test
these fixes comprehensively and I have been short on time recently as well,
so that's the best I can do right now.

Best Regards,
Przemysław Ołtarzewski

On Tue, Apr 9, 2019 at 4:51 PM David Marchand <david.marchand@redhat.com>
wrote:

>
>
> On Tue, Apr 9, 2019 at 4:45 PM <bugzilla@dpdk.org> wrote:
>
>> https://bugs.dpdk.org/show_bug.cgi?id=248
>>
>>             Bug ID: 248
>>            Summary: Bonding PMD: Invalid array dimension in TX burst for
>>                     802.3ad mode with fast queue leads to SEGFAULT
>>            Product: DPDK
>>            Version: 18.11
>>           Hardware: All
>>                 OS: All
>>             Status: CONFIRMED
>>           Severity: major
>>           Priority: Normal
>>          Component: ethdev
>>           Assignee: dev@dpdk.org
>>           Reporter: p.oltarzewski@gmail.com
>>   Target Milestone: ---
>>
>> DPDK 18.11.1
>>
>> In drivers/net/bonding/rte_eth_bond_pmd.c::bond_ethdev_tx_burst_8023ad,
>> bufs_slave_port_idxs array is defined as follows (lines 1293-1294):
>>
>>     /* Mapping array generated by hash function to map mbufs to slaves */
>>     uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
>>
>> Array dimension should be equal to number of packets being transmitted
>> (nb_pkts) - as correctly implemented in
>> rte_eth_bond_pmd.c::bond_ethdev_tx_burst_balance.
>>
>> Invalid array dimension causes overflow when number of transmitted
>> packets is
>> greater than RTE_MAX_ETHPORTS. Some areas of memory end up overwritten
>> (in my
>> particular case, slave_nb_bufs array), which leads to SIGSEGV and crash.
>>
>> To work around the issue, ensure that number of packets transmitted in a
>> single
>> burst is no greater than RTE_MAX_ETHPORTS.
>>
>> To fix it, it should be sufficient to define bufs_slave_port_idxs as a
>> variable-length array, as in bond_ethdev_tx_burst_balance:
>>
>>     /* Mapping array generated by hash function to map mbufs to slaves */
>>     uint16_t bufs_slave_port_idxs[nb_bufs];
>>
>
> I have a series of fixes for this, and on the rx parts as well but did not
> have time to properly check them.
> Would you have some time to test it if I send it ?
>
>
> --
> David Marchand
>

  parent reply	other threads:[~2019-04-10 14:02 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-09 14:44 bugzilla
2019-04-09 14:44 ` bugzilla
2019-04-09 14:51 ` David Marchand
2019-04-09 14:51   ` David Marchand
2019-04-10 11:39   ` Przemysław Ołtarzewski [this message]
2019-04-10 11:39     ` Przemysław Ołtarzewski
2019-04-10 12:56     ` David Marchand
2019-04-10 12:56       ` David Marchand
2019-04-15  9:50       ` Przemysław Ołtarzewski
2019-04-15  9:50         ` Przemysław Ołtarzewski
2019-04-18  9:38         ` Kevin Traynor
2019-04-18  9:38           ` Kevin Traynor

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAFJX8XjAp8pMf5gwFrSz_Aw_M9Lw9QmTC3h0Wp7hTOzkZWzwEg@mail.gmail.com \
    --to=p.oltarzewski@gmail.com \
    --cc=3chas3@gmail.com \
    --cc=david.marchand@redhat.com \
    --cc=dev@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).