From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 6B552A04C3 for ; Fri, 22 Nov 2019 15:41:51 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 5E72791; Fri, 22 Nov 2019 15:41:51 +0100 (CET) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) by dpdk.org (Postfix) with ESMTP id 6A8DD91 for ; Fri, 22 Nov 2019 15:41:50 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1574433709; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=4EQYV7SZ671TeC7VRGxa0tEr1f7BhTz6kiIywiKdfm8=; b=f/NywJLBi307bB485i4WifUTb3nQ9OoB0zivNOeGfhgAAfBUEEeRxQ3PviMTju07kjhKPb Jg7ufMcc9AmA+7UKFkSyF796sESa1/PiV4A2WLE+StPXEMD5EwhaKiiInKFsMR9JStvhvi Iq3s8oDiHw3kTRG80OC9HDbGgl0G/Gw= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-225-KzvNQp06N2CyXYrU0TF6tw-1; Fri, 22 Nov 2019 09:41:45 -0500 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 6C61F10054E3; Fri, 22 Nov 2019 14:41:44 +0000 (UTC) Received: from rh.redhat.com (unknown [10.36.118.60]) by smtp.corp.redhat.com (Postfix) with ESMTP id 281528516; Fri, 22 Nov 2019 14:41:40 +0000 (UTC) From: Kevin Traynor To: David Marchand Cc: Chas Williams , dpdk stable Date: Fri, 22 Nov 2019 14:40:47 +0000 Message-Id: <20191122144131.21231-1-ktraynor@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-MC-Unique: KzvNQp06N2CyXYrU0TF6tw-1 X-Mimecast-Spam-Score: 0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Subject: [dpdk-stable] patch 'net/bonding: fix out of bound access in LACP mode' has been queued to LTS release 18.11.6 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" Hi, FYI, your patch has been queued to LTS release 18.11.6 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 11/29/19. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasi= ng (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://github.com/kevintraynor/dpdk-stable-queue This queued commit can be viewed at: https://github.com/kevintraynor/dpdk-stable-queue/commit/349544cdf8e8c4c076= b123387b2ac7bdf37861af Thanks. Kevin. --- >From 349544cdf8e8c4c076b123387b2ac7bdf37861af Mon Sep 17 00:00:00 2001 From: David Marchand Date: Wed, 10 Apr 2019 14:53:46 +0200 Subject: [PATCH] net/bonding: fix out of bound access in LACP mode [ upstream commit 8ff0003c19412b04f70bfbe59fa52822417f86c3 ] We'd better consolidate the fast queue and the normal tx burst functions under a common inline wrapper for maintenance. But looking closer at the bufs_slave_port_idxs[] mapping array in those tx burst functions, its size is invalid since up to nb_bufs are handled here. A previous patch [1] fixed this issue for balance tx burst function without mentioning it. 802.3ad and balance modes are functionally equivalent on transmit. The only difference is on the slave id distribution. Add an additional inline wrapper to consolidate even more and fix this issue. [1]: https://git.dpdk.org/dpdk/commit/?id=3Dc5224f623431 Fixes: 09150784a776 ("net/bonding: burst mode hash calculation") Signed-off-by: David Marchand Acked-by: Chas Williams --- drivers/net/bonding/rte_eth_bond_pmd.c | 219 ++++++------------------- 1 file changed, 54 insertions(+), 165 deletions(-) diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/r= te_eth_bond_pmd.c index 64518200e..5fd04db17 100644 --- a/drivers/net/bonding/rte_eth_bond_pmd.c +++ b/drivers/net/bonding/rte_eth_bond_pmd.c @@ -3,4 +3,5 @@ */ #include +#include #include =20 @@ -291,95 +292,4 @@ bond_ethdev_rx_burst_8023ad_fast_queue(void *queue, st= ruct rte_mbuf **bufs, } =20 -static uint16_t -bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs= , -=09=09uint16_t nb_bufs) -{ -=09struct bond_tx_queue *bd_tx_q =3D (struct bond_tx_queue *)queue; -=09struct bond_dev_private *internals =3D bd_tx_q->dev_private; - -=09uint16_t slave_port_ids[RTE_MAX_ETHPORTS]; -=09uint16_t slave_count; - -=09uint16_t dist_slave_port_ids[RTE_MAX_ETHPORTS]; -=09uint16_t dist_slave_count; - -=09/* 2-D array to sort mbufs for transmission on each slave into */ -=09struct rte_mbuf *slave_bufs[RTE_MAX_ETHPORTS][nb_bufs]; -=09/* Number of mbufs for transmission on each slave */ -=09uint16_t slave_nb_bufs[RTE_MAX_ETHPORTS] =3D { 0 }; -=09/* Mapping array generated by hash function to map mbufs to slaves */ -=09uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] =3D { 0 }; - -=09uint16_t slave_tx_count; -=09uint16_t total_tx_count =3D 0, total_tx_fail_count =3D 0; - -=09uint16_t i; - -=09if (unlikely(nb_bufs =3D=3D 0)) -=09=09return 0; - -=09/* Copy slave list to protect against slave up/down changes during tx -=09 * bursting */ -=09slave_count =3D internals->active_slave_count; -=09if (unlikely(slave_count < 1)) -=09=09return 0; - -=09memcpy(slave_port_ids, internals->active_slaves, -=09=09=09sizeof(slave_port_ids[0]) * slave_count); - - -=09dist_slave_count =3D 0; -=09for (i =3D 0; i < slave_count; i++) { -=09=09struct port *port =3D &bond_mode_8023ad_ports[slave_port_ids[i]]; - -=09=09if (ACTOR_STATE(port, DISTRIBUTING)) -=09=09=09dist_slave_port_ids[dist_slave_count++] =3D -=09=09=09=09=09slave_port_ids[i]; -=09} - -=09if (unlikely(dist_slave_count < 1)) -=09=09return 0; - -=09/* -=09 * Populate slaves mbuf with the packets which are to be sent on it -=09 * selecting output slave using hash based on xmit policy -=09 */ -=09internals->burst_xmit_hash(bufs, nb_bufs, dist_slave_count, -=09=09=09bufs_slave_port_idxs); - -=09for (i =3D 0; i < nb_bufs; i++) { -=09=09/* Populate slave mbuf arrays with mbufs for that slave. */ -=09=09uint16_t slave_idx =3D bufs_slave_port_idxs[i]; - -=09=09slave_bufs[slave_idx][slave_nb_bufs[slave_idx]++] =3D bufs[i]; -=09} - - -=09/* Send packet burst on each slave device */ -=09for (i =3D 0; i < dist_slave_count; i++) { -=09=09if (slave_nb_bufs[i] =3D=3D 0) -=09=09=09continue; - -=09=09slave_tx_count =3D rte_eth_tx_burst(dist_slave_port_ids[i], -=09=09=09=09bd_tx_q->queue_id, slave_bufs[i], -=09=09=09=09slave_nb_bufs[i]); - -=09=09total_tx_count +=3D slave_tx_count; - -=09=09/* If tx burst fails move packets to end of bufs */ -=09=09if (unlikely(slave_tx_count < slave_nb_bufs[i])) { -=09=09=09int slave_tx_fail_count =3D slave_nb_bufs[i] - -=09=09=09=09=09slave_tx_count; -=09=09=09total_tx_fail_count +=3D slave_tx_fail_count; -=09=09=09memcpy(&bufs[nb_bufs - total_tx_fail_count], -=09=09=09 &slave_bufs[i][slave_tx_count], -=09=09=09 slave_tx_fail_count * sizeof(bufs[0])); -=09=09} -=09} - -=09return total_tx_count; -} - - static uint16_t bond_ethdev_rx_burst_8023ad(void *queue, struct rte_mbuf **bufs, @@ -1197,14 +1107,11 @@ bond_ethdev_tx_burst_alb(void *queue, struct rte_mb= uf **bufs, uint16_t nb_pkts) } =20 -static uint16_t -bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs, -=09=09uint16_t nb_bufs) +static inline uint16_t +tx_burst_balance(void *queue, struct rte_mbuf **bufs, uint16_t nb_bufs, +=09=09 uint16_t *slave_port_ids, uint16_t slave_count) { =09struct bond_tx_queue *bd_tx_q =3D (struct bond_tx_queue *)queue; =09struct bond_dev_private *internals =3D bd_tx_q->dev_private; =20 -=09uint16_t slave_port_ids[RTE_MAX_ETHPORTS]; -=09uint16_t slave_count; - =09/* Array to sort mbufs for transmission on each slave into */ =09struct rte_mbuf *slave_bufs[RTE_MAX_ETHPORTS][nb_bufs]; @@ -1219,16 +1126,4 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte= _mbuf **bufs, =09uint16_t i; =20 -=09if (unlikely(nb_bufs =3D=3D 0)) -=09=09return 0; - -=09/* Copy slave list to protect against slave up/down changes during tx -=09 * bursting */ -=09slave_count =3D internals->active_slave_count; -=09if (unlikely(slave_count < 1)) -=09=09return 0; - -=09memcpy(slave_port_ids, internals->active_slaves, -=09=09=09sizeof(slave_port_ids[0]) * slave_count); - =09/* =09 * Populate slaves mbuf with the packets which are to be sent on it @@ -1271,5 +1166,5 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_= mbuf **bufs, =20 static uint16_t -bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs, +bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs, =09=09uint16_t nb_bufs) { @@ -1280,16 +1175,34 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte= _mbuf **bufs, =09uint16_t slave_count; =20 +=09if (unlikely(nb_bufs =3D=3D 0)) +=09=09return 0; + +=09/* Copy slave list to protect against slave up/down changes during tx +=09 * bursting +=09 */ +=09slave_count =3D internals->active_slave_count; +=09if (unlikely(slave_count < 1)) +=09=09return 0; + +=09memcpy(slave_port_ids, internals->active_slaves, +=09=09=09sizeof(slave_port_ids[0]) * slave_count); +=09return tx_burst_balance(queue, bufs, nb_bufs, slave_port_ids, +=09=09=09=09slave_count); +} + +static inline uint16_t +tx_burst_8023ad(void *queue, struct rte_mbuf **bufs, uint16_t nb_bufs, +=09=09bool dedicated_txq) +{ +=09struct bond_tx_queue *bd_tx_q =3D (struct bond_tx_queue *)queue; +=09struct bond_dev_private *internals =3D bd_tx_q->dev_private; + +=09uint16_t slave_port_ids[RTE_MAX_ETHPORTS]; +=09uint16_t slave_count; + =09uint16_t dist_slave_port_ids[RTE_MAX_ETHPORTS]; =09uint16_t dist_slave_count; =20 -=09/* 2-D array to sort mbufs for transmission on each slave into */ -=09struct rte_mbuf *slave_bufs[RTE_MAX_ETHPORTS][nb_bufs]; -=09/* Number of mbufs for transmission on each slave */ -=09uint16_t slave_nb_bufs[RTE_MAX_ETHPORTS] =3D { 0 }; -=09/* Mapping array generated by hash function to map mbufs to slaves */ -=09uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] =3D { 0 }; - =09uint16_t slave_tx_count; -=09uint16_t total_tx_count =3D 0, total_tx_fail_count =3D 0; =20 =09uint16_t i; @@ -1304,4 +1217,7 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_m= buf **bufs, =09=09=09sizeof(slave_port_ids[0]) * slave_count); =20 +=09if (dedicated_txq) +=09=09goto skip_tx_ring; + =09/* Check for LACP control packets and send if available */ =09for (i =3D 0; i < slave_count; i++) { @@ -1325,4 +1241,5 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_m= buf **bufs, =09} =20 +skip_tx_ring: =09if (unlikely(nb_bufs =3D=3D 0)) =09=09return 0; @@ -1337,51 +1254,23 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte= _mbuf **bufs, =09} =20 -=09if (likely(dist_slave_count > 0)) { - -=09=09/* -=09=09 * Populate slaves mbuf with the packets which are to be sent -=09=09 * on it, selecting output slave using hash based on xmit policy -=09=09 */ -=09=09internals->burst_xmit_hash(bufs, nb_bufs, dist_slave_count, -=09=09=09=09bufs_slave_port_idxs); - -=09=09for (i =3D 0; i < nb_bufs; i++) { -=09=09=09/* -=09=09=09 * Populate slave mbuf arrays with mbufs for that -=09=09=09 * slave -=09=09=09 */ -=09=09=09uint16_t slave_idx =3D bufs_slave_port_idxs[i]; - -=09=09=09slave_bufs[slave_idx][slave_nb_bufs[slave_idx]++] =3D -=09=09=09=09=09bufs[i]; -=09=09} - - -=09=09/* Send packet burst on each slave device */ -=09=09for (i =3D 0; i < dist_slave_count; i++) { -=09=09=09if (slave_nb_bufs[i] =3D=3D 0) -=09=09=09=09continue; - -=09=09=09slave_tx_count =3D rte_eth_tx_burst( -=09=09=09=09=09dist_slave_port_ids[i], -=09=09=09=09=09bd_tx_q->queue_id, slave_bufs[i], -=09=09=09=09=09slave_nb_bufs[i]); - -=09=09=09total_tx_count +=3D slave_tx_count; - -=09=09=09/* If tx burst fails move packets to end of bufs */ -=09=09=09if (unlikely(slave_tx_count < slave_nb_bufs[i])) { -=09=09=09=09int slave_tx_fail_count =3D slave_nb_bufs[i] - -=09=09=09=09=09=09slave_tx_count; -=09=09=09=09total_tx_fail_count +=3D slave_tx_fail_count; - -=09=09=09=09memcpy(&bufs[nb_bufs - total_tx_fail_count], -=09=09=09=09 &slave_bufs[i][slave_tx_count], -=09=09=09=09 slave_tx_fail_count * sizeof(bufs[0])); -=09=09=09} -=09=09} -=09} - -=09return total_tx_count; +=09if (unlikely(dist_slave_count < 1)) +=09=09return 0; + +=09return tx_burst_balance(queue, bufs, nb_bufs, dist_slave_port_ids, +=09=09=09=09dist_slave_count); +} + +static uint16_t +bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs, +=09=09uint16_t nb_bufs) +{ +=09return tx_burst_8023ad(queue, bufs, nb_bufs, false); +} + +static uint16_t +bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs= , +=09=09uint16_t nb_bufs) +{ +=09return tx_burst_8023ad(queue, bufs, nb_bufs, true); } =20 --=20 2.21.0 --- Diff of the applied patch vs upstream commit (please double-check if non-= empty: --- --- -=092019-11-22 14:36:55.274092073 +0000 +++ 0001-net-bonding-fix-out-of-bound-access-in-LACP-mode.patch=092019-11-2= 2 14:36:55.105151252 +0000 @@ -1 +1 @@ -From 8ff0003c19412b04f70bfbe59fa52822417f86c3 Mon Sep 17 00:00:00 2001 +From 349544cdf8e8c4c076b123387b2ac7bdf37861af Mon Sep 17 00:00:00 2001 @@ -5,0 +6,2 @@ +[ upstream commit 8ff0003c19412b04f70bfbe59fa52822417f86c3 ] + @@ -23 +24,0 @@ -Cc: stable@dpdk.org @@ -32 +33 @@ -index 6a6ed890a..6abd9581c 100644 +index 64518200e..5fd04db17 100644 @@ -41 +42 @@ -@@ -293,95 +294,4 @@ bond_ethdev_rx_burst_8023ad_fast_queue(void *queue, s= truct rte_mbuf **bufs, +@@ -291,95 +292,4 @@ bond_ethdev_rx_burst_8023ad_fast_queue(void *queue, s= truct rte_mbuf **bufs, @@ -137 +138 @@ -@@ -1213,14 +1123,11 @@ bond_ethdev_tx_burst_alb(void *queue, struct rte_m= buf **bufs, uint16_t nb_pkts) +@@ -1197,14 +1107,11 @@ bond_ethdev_tx_burst_alb(void *queue, struct rte_m= buf **bufs, uint16_t nb_pkts) @@ -155 +156 @@ -@@ -1235,16 +1142,4 @@ bond_ethdev_tx_burst_balance(void *queue, struct rt= e_mbuf **bufs, +@@ -1219,16 +1126,4 @@ bond_ethdev_tx_burst_balance(void *queue, struct rt= e_mbuf **bufs, @@ -172 +173 @@ -@@ -1287,5 +1182,5 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte= _mbuf **bufs, +@@ -1271,5 +1166,5 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte= _mbuf **bufs, @@ -179 +180 @@ -@@ -1296,16 +1191,34 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rt= e_mbuf **bufs, +@@ -1280,16 +1175,34 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rt= e_mbuf **bufs, @@ -222 +223 @@ -@@ -1320,4 +1233,7 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_= mbuf **bufs, +@@ -1304,4 +1217,7 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_= mbuf **bufs, @@ -230 +231 @@ -@@ -1341,4 +1257,5 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_= mbuf **bufs, +@@ -1325,4 +1241,5 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_= mbuf **bufs, @@ -236 +237 @@ -@@ -1353,51 +1270,23 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rt= e_mbuf **bufs, +@@ -1337,51 +1254,23 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rt= e_mbuf **bufs,