From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124])
by inbox.dpdk.org (Postfix) with ESMTP id 3D49E43437;
Tue, 5 Dec 2023 05:05:36 +0100 (CET)
Received: from mails.dpdk.org (localhost [127.0.0.1])
by mails.dpdk.org (Postfix) with ESMTP id D977742D45;
Tue, 5 Dec 2023 05:05:35 +0100 (CET)
Received: from foss.arm.com (foss.arm.com [217.140.110.172])
by mails.dpdk.org (Postfix) with ESMTP id BDF2E4064A;
Tue, 5 Dec 2023 05:05:34 +0100 (CET)
Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14])
by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id BA17C1474;
Mon, 4 Dec 2023 20:06:20 -0800 (PST)
Received: from net-arm-n1amp-02.shanghai.arm.com
(net-arm-n1amp-02.shanghai.arm.com [10.169.210.107])
by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 6A7313F5A1;
Mon, 4 Dec 2023 20:05:31 -0800 (PST)
From: Joyce Kong <joyce.kong@arm.com>
To: Jakub Grajciar <jgrajcia@cisco.com>,
=?UTF-8?q?Morten=20Br=C3=B8rup?= <mb@smartsharesystems.com>,
Joyce Kong <joyce.kong@arm.com>, Ruifeng Wang <ruifeng.wang@arm.com>
Cc: dev@dpdk.org, nd@arm.com, stable@dpdk.org,
Liangxing Wang <liangxing.wang@arm.com>
Subject: [PATCH v1] net/memif: fix segfault with Tx burst larger than 255
Date: Tue, 5 Dec 2023 04:05:24 +0000
Message-Id: <20231205040524.3525473-1-joyce.kong@arm.com>
X-Mailer: git-send-email 2.25.1
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
<mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
<mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
There will be a segfault when tx burst size is larger than
256. This is because eth_memif_tx uses an index i which is
uint8_t to count transmitted nb_pkts. Extend i to uint16_t,
the same size as nb_pkts.
Fixes: b5613c8f9d0a ("net/memif: add a Tx fast path")
Cc: stable@dpdk.org
Reported-by: Liangxing Wang <liangxing.wang@arm.com>
Signed-off-by: Joyce Kong <joyce.kong@arm.com>
Reviewed-by: Ruifeng Wang <ruifeng.wang@arm.com>
---
drivers/net/memif/rte_eth_memif.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c
index 7cc8c0da91..6f45a00172 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -684,7 +684,7 @@ eth_memif_tx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
n_free = __atomic_load_n(&ring->head, __ATOMIC_ACQUIRE) - slot;
}
- uint8_t i;
+ uint16_t i;
struct rte_mbuf **buf_tmp = bufs;
mbuf_head = *buf_tmp++;
struct rte_mempool *mp = mbuf_head->pool;
--
2.25.1