DPDK patches and discussions
 help / color / mirror / Atom feed
From: Stephen Hemminger <stephen@networkplumber.org>
To: Konstantin Ananyev <konstantin.v.ananyev@yandex.ru>
Cc: dev@dpdk.org, songx.jiale@intel.com,
	Konstantin Ananyev <konstantin.ananyev@huawei.com>,
	stable@dpdk.org
Subject: Re: [PATCH v2 1/2] examples/l3fwd: fix read beyond array bondaries
Date: Wed, 9 Oct 2024 17:30:13 -0700	[thread overview]
Message-ID: <20241009173013.0d964751@hermes.local> (raw)
In-Reply-To: <20240730122235.1084-2-konstantin.v.ananyev@yandex.ru>

On Tue, 30 Jul 2024 13:22:34 +0100
Konstantin Ananyev <konstantin.v.ananyev@yandex.ru> wrote:

> From: Konstantin Ananyev <konstantin.ananyev@huawei.com>
> 
> ASAN report:
> ERROR: AddressSanitizer: unknown-crash on address 0x7ffffef92e32 at pc 0x00000053d1e9 bp 0x7ffffef92c00 sp 0x7ffffef92bf8
> READ of size 16 at 0x7ffffef92e32 thread T0
>     #0 0x53d1e8 in _mm_loadu_si128 /usr/lib64/gcc/x86_64-suse-linux/11/include/emmintrin.h:703
>     #1 0x53d1e8 in send_packets_multi ../examples/l3fwd/l3fwd_sse.h:125
>     #2 0x53d1e8 in acl_send_packets ../examples/l3fwd/l3fwd_acl.c:1048
>     #3 0x53ec18 in acl_main_loop ../examples/l3fwd/l3fwd_acl.c:1127
>     #4 0x12151eb in rte_eal_mp_remote_launch ../lib/eal/common/eal_common_launch.c:83
>     #5 0x5bf2df in main ../examples/l3fwd/main.c:1647
>     #6 0x7f6d42a0d2bc in __libc_start_main (/lib64/libc.so.6+0x352bc)
>     #7 0x527499 in _start (/home/kananyev/dpdk-l3fwd-acl/x86_64-native-linuxapp-gcc-dbg-b1/examples/dpdk-l3fwd+0x527499)
> 
> Reason for that is that send_packets_multi() uses 16B loads to access
> input dst_port[]and might read beyond array boundaries.
> Right now, it doesn't cause any real issue - junk values are ignored, also
> inside l3fwd we always allocate dst_port[] array on the stack, so
> memory beyond it is always available.
> Anyway, it probably need to be fixed.
> The patch below simply allocates extra space for dst_port[], so
> send_packets_multi() will never read beyond its boundaries.
> 
> Probably a better fix would be to change send_packets_multi()
> itself to avoid access beyond 'nb_rx' entries.
> 
> Bugzilla ID: 1502
> Fixes: 94c54b4158d5 ("examples/l3fwd: rework exact-match")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Konstantin Ananyev <konstantin.ananyev@huawei.com>

Acked-by: Stephen Hemminger <stephen@networkplumber.org>

  reply	other threads:[~2024-10-10  0:30 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-07-26 19:43 [PATCH] " Konstantin Ananyev
2024-07-30 12:22 ` [PATCH v2 0/2] examples/l3fwd fixes for ACL mode Konstantin Ananyev
2024-07-30 12:22   ` [PATCH v2 1/2] examples/l3fwd: fix read beyond array bondaries Konstantin Ananyev
2024-10-10  0:30     ` Stephen Hemminger [this message]
2024-07-30 12:22   ` [PATCH v2 2/2] examples/l3fwd: fix read beyond array boundaries in ACL mode Konstantin Ananyev
2024-10-10  0:30     ` Stephen Hemminger
2024-10-12  2:43     ` Stephen Hemminger
2024-11-07 18:50   ` [PATCH v3 0/2] examples/l3fwd fixes for " Konstantin Ananyev
2024-11-07 18:50     ` [PATCH v3 1/2] examples/l3fwd: fix read beyond array bondaries Konstantin Ananyev
2024-11-07 18:50     ` [PATCH v3 2/2] examples/l3fwd: fix read beyond array boundaries in ACL mode Konstantin Ananyev
2024-11-11 14:06     ` [PATCH v3 0/2] examples/l3fwd fixes for " Thomas Monjalon

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20241009173013.0d964751@hermes.local \
    --to=stephen@networkplumber.org \
    --cc=dev@dpdk.org \
    --cc=konstantin.ananyev@huawei.com \
    --cc=konstantin.v.ananyev@yandex.ru \
    --cc=songx.jiale@intel.com \
    --cc=stable@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).