From: David Marchand <david.marchand@redhat.com>
To: p.oltarzewski@gmail.com, Chas Williams <3chas3@gmail.com>
Cc: dev <dev@dpdk.org>
Subject: Re: [dpdk-dev] [Bug 248] Bonding PMD: Invalid array dimension in TX burst for 802.3ad mode with fast queue leads to SEGFAULT
Date: Tue, 9 Apr 2019 16:51:08 +0200 [thread overview]
Message-ID: <CAJFAV8y5V9v1dA7Vx3_7ZoqupYvhvD-BtbR1dt5KOsCt5J2S+g@mail.gmail.com> (raw)
In-Reply-To: <bug-248-3@http.bugs.dpdk.org/>
On Tue, Apr 9, 2019 at 4:45 PM <bugzilla@dpdk.org> wrote:
> https://bugs.dpdk.org/show_bug.cgi?id=248
>
> Bug ID: 248
> Summary: Bonding PMD: Invalid array dimension in TX burst for
> 802.3ad mode with fast queue leads to SEGFAULT
> Product: DPDK
> Version: 18.11
> Hardware: All
> OS: All
> Status: CONFIRMED
> Severity: major
> Priority: Normal
> Component: ethdev
> Assignee: dev@dpdk.org
> Reporter: p.oltarzewski@gmail.com
> Target Milestone: ---
>
> DPDK 18.11.1
>
> In drivers/net/bonding/rte_eth_bond_pmd.c::bond_ethdev_tx_burst_8023ad,
> bufs_slave_port_idxs array is defined as follows (lines 1293-1294):
>
> /* Mapping array generated by hash function to map mbufs to slaves */
> uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
>
> Array dimension should be equal to number of packets being transmitted
> (nb_pkts) - as correctly implemented in
> rte_eth_bond_pmd.c::bond_ethdev_tx_burst_balance.
>
> Invalid array dimension causes overflow when number of transmitted packets
> is
> greater than RTE_MAX_ETHPORTS. Some areas of memory end up overwritten (in
> my
> particular case, slave_nb_bufs array), which leads to SIGSEGV and crash.
>
> To work around the issue, ensure that number of packets transmitted in a
> single
> burst is no greater than RTE_MAX_ETHPORTS.
>
> To fix it, it should be sufficient to define bufs_slave_port_idxs as a
> variable-length array, as in bond_ethdev_tx_burst_balance:
>
> /* Mapping array generated by hash function to map mbufs to slaves */
> uint16_t bufs_slave_port_idxs[nb_bufs];
>
I have a series of fixes for this, and on the rx parts as well but did not
have time to properly check them.
Would you have some time to test it if I send it ?
--
David Marchand
next prev parent reply other threads:[~2019-04-09 14:51 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-09 14:44 bugzilla
2019-04-09 14:44 ` bugzilla
2019-04-09 14:51 ` David Marchand [this message]
2019-04-09 14:51 ` David Marchand
2019-04-10 11:39 ` Przemysław Ołtarzewski
2019-04-10 11:39 ` Przemysław Ołtarzewski
2019-04-10 12:56 ` David Marchand
2019-04-10 12:56 ` David Marchand
2019-04-15 9:50 ` Przemysław Ołtarzewski
2019-04-15 9:50 ` Przemysław Ołtarzewski
2019-04-18 9:38 ` Kevin Traynor
2019-04-18 9:38 ` Kevin Traynor
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJFAV8y5V9v1dA7Vx3_7ZoqupYvhvD-BtbR1dt5KOsCt5J2S+g@mail.gmail.com \
--to=david.marchand@redhat.com \
--cc=3chas3@gmail.com \
--cc=dev@dpdk.org \
--cc=p.oltarzewski@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).