From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id C41EF41E27; Wed, 8 Mar 2023 15:09:17 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 676C0410EE; Wed, 8 Mar 2023 15:09:17 +0100 (CET) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mails.dpdk.org (Postfix) with ESMTP id 9904440FAE for ; Wed, 8 Mar 2023 15:09:15 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1678284555; x=1709820555; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=RwUKD034HKrlyOuMCLnSEhY9ITOaeXiOsLsiexKKP5A=; b=SCO1imYJDqLmH8UAB1XqttezrQJNzAnfuF2rtue9pnJjm7ZfOAE8OuHe noNqCq8HDfcgyN3OPZGHu8odxcc/J9YrzIpedkPPKG/PJLrKIh0CSmNEh maxaIAh5TS2KaBd9vULN46Sv3jP0de2v7J7YXltSCWtoGSy1/jptcBNE2 /b4OkTykEy/QTQuCvDBZjXQHG0oD5ujSyIlAu9nE1R3YhMdV+wRHHF5AW jyWfB/JmV/87D2ok54+3o5pH0m2SoMuz1mryNCVDtP3BPst5CJvESqC5Y yNUAn8OWvaHlsa66sHljzVZu57yXzGbRGYHi39BwKPL5f1nysUgu//9kd Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10642"; a="422429542" X-IronPort-AV: E=Sophos;i="5.98,244,1673942400"; d="scan'208";a="422429542" Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Mar 2023 06:09:14 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6500,9779,10642"; a="800763118" X-IronPort-AV: E=Sophos;i="5.98,244,1673942400"; d="scan'208";a="800763118" Received: from silpixa00401385.ir.intel.com ([10.237.214.37]) by orsmga004.jf.intel.com with ESMTP; 08 Mar 2023 06:09:13 -0800 From: Bruce Richardson To: dev@dpdk.org Cc: Bruce Richardson , Megha Ajmera , Cristian Dumitrescu Subject: [PATCH] examples/qos_sched: fix buffer overflow on mbuf free Date: Wed, 8 Mar 2023 14:09:02 +0000 Message-Id: <20230308140902.269982-1-bruce.richardson@intel.com> X-Mailer: git-send-email 2.37.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org When running the qos_sched app with separated worker and Tx threads, the app would seg-fault after a short time of handling packets. The root cause of this turns out to be an incorrect array index when freeing unsent packets post-Tx. Rather than freeing packets using the "nb_tx" value i.e. where transmission failed, the function was freeing packets using the "nb_pkts" value, i.e. going beyond the number of packets previously received into the buffer. Fixes: 39b25117c40b ("examples/qos_sched: remove Tx buffering") Reported-by: Megha Ajmera Signed-off-by: Bruce Richardson --- examples/qos_sched/app_thread.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/qos_sched/app_thread.c b/examples/qos_sched/app_thread.c index 1ea732aa91..059c470afb 100644 --- a/examples/qos_sched/app_thread.c +++ b/examples/qos_sched/app_thread.c @@ -118,7 +118,7 @@ app_tx_thread(struct thread_conf **confs) if (likely(nb_pkts != 0)) { uint16_t nb_tx = rte_eth_tx_burst(conf->tx_port, 0, mbufs, nb_pkts); if (nb_pkts != nb_tx) - rte_pktmbuf_free_bulk(&mbufs[nb_pkts], nb_pkts - nb_tx); + rte_pktmbuf_free_bulk(&mbufs[nb_tx], nb_pkts - nb_tx); } conf_idx++; -- 2.37.2