From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id C9E0BA0032; Sat, 2 Oct 2021 17:45:06 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 5ED40411A0; Sat, 2 Oct 2021 17:45:06 +0200 (CEST) Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178]) by mails.dpdk.org (Postfix) with ESMTP id 168EB4067B for ; Sat, 2 Oct 2021 17:45:05 +0200 (CEST) Received: by inbox.dpdk.org (Postfix, from userid 33) id ED2B8A0547; Sat, 2 Oct 2021 17:45:04 +0200 (CEST) From: bugzilla@dpdk.org To: dev@dpdk.org Date: Sat, 02 Oct 2021 15:45:04 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: DPDK X-Bugzilla-Component: other X-Bugzilla-Version: unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: david.marchand@redhat.com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: Normal X-Bugzilla-Assigned-To: dev@dpdk.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter cc target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All MIME-Version: 1.0 Subject: [dpdk-dev] [Bug 820] [asan] table: buffer overflow in table_autotest X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" https://bugs.dpdk.org/show_bug.cgi?id=3D820 Bug ID: 820 Summary: [asan] table: buffer overflow in table_autotest Product: DPDK Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: Normal Component: other Assignee: dev@dpdk.org Reporter: david.marchand@redhat.com CC: cristian.dumitrescu@intel.com Target Milestone: --- This issue was caught by ASAN. To reproduce, please look at the last patch of series 18997: https://github.com/ovsrobot/dpdk/commit/series_18997 64/94 DPDK:fast-tests / table_autotest FAIL 1.02 s (exit status = 1) --- command --- DPDK_TEST=3D'table_autotest' /home/runner/work/dpdk/dpdk/build/app/test/dpd= k-test -l 0-1 --file-prefix=3Dtable_autotest --- stdout --- RTE>>table_autotest Getting/Creating the mempool ... ************Pipeline tests************ Added default entry to table id 0 with action 0 Added default entry to table id 1 with action 0 Pipeline Consistency OK! Got no objects from ring 0 - error code 0 Got no objects from ring 1 - error code 0 Added default entry to table id 0 with action 1 Added default entry to table id 1 with action 1 Pipeline Consistency OK! Got 2 object(s) from ring 0! Object: at [0x7f55b8c85a00], len=3D0 Object: at [0x7f55b8c86340], len=3D0 Got 2 object(s) from ring 1! Object: at [0x7f55b8c84780], len=3D0 Object: at [0x7f55b8c850c0], len=3D0 Added default entry to table id 0 with action 1 Added default entry to table id 1 with action 1 Pipeline Consistency OK! STUB Table Action Miss - setting mask to 0x1 STUB Table Action Miss - setting mask to 0x1 Got 1 object(s) from ring 0! Object: at [0x7f55b8c86340], len=3D0 Got 1 object(s) from ring 1! Object: at [0x7f55b8c850c0], len=3D0 Added default entry to table id 0 with action 1 Added default entry to table id 1 with action 1 Pipeline Consistency OK! STUB Table Action Miss - setting mask to 0x2 STUB Table Action Miss - setting mask to 0x2 Got 1 object(s) from ring 0! Object: at [0x7f55b8c84780], len=3D0 Got 1 object(s) from ring 1! Object: at [0x7f55b8c86340], len=3D0 Added default entry to table id 0 with action 1 Added default entry to table id 1 with action 1 Pipeline Consistency OK! STUB Table Action Miss - setting mask to 0x3 STUB Table Action Miss - setting mask to 0x3 Got 2 object(s) from ring 0! Object: at [0x7f55b8c85a00], len=3D0 Object: at [0x7f55b8c850c0], len=3D0 Got 2 object(s) from ring 1! Object: at [0x7f55b8c86340], len=3D0 Object: at [0x7f55b8c84780], len=3D0 Setting first table to output to next table Added default entry to table id 0 with action 3 Setting secont table to output to port Added default entry to table id 0 with action 1 Setting first table to output to next table Added default entry to table id 2 with action 3 Setting secont table to output to port Added default entry to table id 2 with action 1 Pipeline Consistency OK! Got 2 object(s) from ring 0! Object: at [0x7f55b8c850c0], len=3D0 Object: at [0x7f55b8c85a00], len=3D0 Got 2 object(s) from ring 1! Object: at [0x7f55b8c84780], len=3D0 Object: at [0x7f55b8c86340], len=3D0 TEST - two tables, hitmask override to 0x01 Setting first table to output to next table Added default entry to table id 0 with action 3 Setting secont table to output to port Added default entry to table id 0 with action 1 Setting first table to output to next table Added default entry to table id 2 with action 3 Setting secont table to output to port Added default entry to table id 2 with action 1 Pipeline Consistency OK! STUB Table Action Miss - setting mask to 0x1 STUB Table Action Miss - setting mask to 0x1 STUB Table Action Miss - setting mask to 0x1 STUB Table Action Miss - setting mask to 0x1 Got 1 object(s) from ring 0! Object: at [0x7f55b8c85a00], len=3D0 Got 1 object(s) from ring 1! Object: at [0x7f55b8c86340], len=3D0 --- stderr --- EAL: Detected 2 lcore(s) EAL: Detected 1 NUMA nodes EAL: Detected shared linkage of DPDK EAL: WARNING! Base virtual address hint (0x100005000 !=3D 0x7f59cb695000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: Multi-process socket /var/run/dpdk/table_autotest/mp_socket EAL: Selected IOVA mode 'PA' EAL: No available 1048576 kB hugepages reported EAL: VFIO support initialized EAL: WARNING! Base virtual address hint (0x10000b000 !=3D 0x7f59ba293000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x100011000 !=3D 0x7f59ba232000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x100a12000 !=3D 0x7f55b8400000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x100c17000 !=3D 0x7f59ba09f000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x101618000 !=3D 0x7f51b8200000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x10181d000 !=3D 0x7f59ba03e000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x10221e000 !=3D 0x7f4db8000000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x102423000 !=3D 0x7f59b9e9f000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes EAL: WARNING! Base virtual address hint (0x102e24000 !=3D 0x7f49b7e00000) n= ot respected! EAL: This may cause issues with mapping memory into secondary processes APP: HPET is not enabled, using TSC as default timer PIPELINE: setup_pipeline: **** Setting up Stub test PIPELINE: test_pipeline_single_filter: **** Running Stub test PIPELINE: rte_pipeline_flush: pipeline parameter NULL PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: setup_pipeline: **** Setting up Stub test PIPELINE: test_pipeline_single_filter: **** Running Stub test PIPELINE: rte_pipeline_flush: pipeline parameter NULL PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: setup_pipeline: **** Setting up Stub test PIPELINE: test_pipeline_single_filter: **** Running Stub test PIPELINE: rte_pipeline_flush: pipeline parameter NULL PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: setup_pipeline: **** Setting up Stub test PIPELINE: test_pipeline_single_filter: **** Running Stub test PIPELINE: rte_pipeline_flush: pipeline parameter NULL PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: setup_pipeline: **** Setting up Stub test PIPELINE: test_pipeline_single_filter: **** Running Stub test PIPELINE: rte_pipeline_flush: pipeline parameter NULL PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: setup_pipeline: **** Setting up Stub test PIPELINE: test_pipeline_single_filter: **** Running Stub test PIPELINE: rte_pipeline_flush: pipeline parameter NULL PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: setup_pipeline: **** Setting up Stub test PIPELINE: test_pipeline_single_filter: **** Running Stub test PIPELINE: rte_pipeline_flush: pipeline parameter NULL PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 0 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: test_pipeline_single_filter: Enqueue onto ring 1 PIPELINE: rte_pipeline_check_params: Incorrect value for parameter params PIPELINE: rte_pipeline_create: Pipeline params check failed (-22) PIPELINE: rte_pipeline_check_params: Incorrect value for parameter name PIPELINE: rte_pipeline_create: Pipeline params check failed (-22) PIPELINE: rte_pipeline_check_params: Incorrect value for parameter socket_id PIPELINE: rte_pipeline_create: Pipeline params check failed (-22) PIPELINE: rte_pipeline_create: Pipeline memory allocation failed PIPELINE: rte_pipeline_check: pipeline parameter NULL PORT: rte_port_ring_reader_create_internal: Invalid Parameters PORT: rte_port_ring_reader_free: port is NULL PORT: rte_port_ring_writer_create_internal: Invalid Parameters PORT: rte_port_ring_writer_free: Port is NULL PORT: rte_port_ring_writer_create_internal: Invalid Parameters PORT: rte_port_ring_writer_create_internal: Invalid Parameters TABLE: rte_table_array_free: table parameter is NULL TABLE: rte_table_array_entry_add: table parameter is NULL TABLE: rte_table_array_entry_add: entry parameter is NULL TABLE: rte_table_lpm_create: NULL input parameters TABLE: rte_table_lpm_create: Table name is NULL TABLE: rte_table_lpm_create: Invalid n_rules TABLE: rte_table_lpm_create: Invalid entry_unique_size TABLE: rte_table_lpm_create: Invalid entry_unique_size TABLE: rte_table_lpm_free: table parameter is NULL TABLE: rte_table_lpm_entry_add: table parameter is NULL TABLE: rte_table_lpm_entry_add: ip_prefix parameter is NULL TABLE: rte_table_lpm_entry_add: entry parameter is NULL TABLE: rte_table_lpm_entry_add: invalid depth (0) TABLE: rte_table_lpm_entry_add: invalid depth (33) =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D25453=3D=3DERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd7a7c0d01 at pc 0x0000004a5d5a bp 0x7ffd7a7c0570 sp 0x7ffd7a7bfd38 READ of size 8 at 0x7ffd7a7c0d01 thread T0 #0 0x4a5d59 in __asan_memcpy (/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x4a5d59) #1 0x7f59c62f18e9 in rte_table_lpm_entry_add /home/runner/work/dpdk/dpdk/build/../lib/table/rte_table_lpm.c:226:3 #2 0x2d1e6b2 in test_table_lpm /home/runner/work/dpdk/dpdk/build/../app/test/test_table_tables.c:390:11 #3 0x2b26a0f in test_table /home/runner/work/dpdk/dpdk/build/../app/test/test_table.c:163:12 #4 0x4d6166 in cmd_autotest_parsed /home/runner/work/dpdk/dpdk/build/../app/test/commands.c:71:10 #5 0x7f59c7def6c5 in cmdline_parse /home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_parse.c:290:3 #6 0x7f59c7de88d5 in cmdline_valid_buffer /home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:26:8 #7 0x7f59c7df9f07 in rdline_char_in /home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_rdline.c:421:5 #8 0x7f59c7de903f in cmdline_in /home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:149:9 #9 0x5ac68e in main /home/runner/work/dpdk/dpdk/build/../app/test/test.c:214:8 #10 0x7f59c0446bf6 in __libc_start_main /build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310 #11 0x42ea19 in _start (/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x42ea19) Address 0x7ffd7a7c0d01 is located in stack of thread T0 at offset 1217 in f= rame #0 0x2d1d5cf in test_table_lpm /home/runner/work/dpdk/dpdk/build/../app/test/test_table_tables.c:287 This frame has 8 object(s): [32, 40) 'result_mask' (line 289) [64, 576) 'mbufs' (line 290) [640, 1152) 'entries' (line 292) [1216, 1217) 'entry1' (line 293) <=3D=3D Memory access at offset 1217 o= verflows this variable [1232, 1240) 'entry_ptr' (line 294) [1264, 1268) 'key_found' (line 295) [1280, 1312) 'lpm_params' (line 299) [1344, 1352) 'lpm_key' (line 355) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow (/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x4a5d59) in __asan_memcpy Shadow bytes around the buggy address: 0x10002f4f0150: f2 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 0x10002f4f0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002f4f0170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002f4f0180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002f4f0190: 00 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 f2 f2 f2 =3D>0x10002f4f01a0:[01]f2 00 f2 f2 f2 04 f2 00 00 00 00 f2 f2 f2 f2 0x10002f4f01b0: 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 0x10002f4f01c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002f4f01d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002f4f01e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x10002f4f01f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07=20 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc =3D=3D25453=3D=3DABORTING --=20 You are receiving this mail because: You are the assignee for the bug.=