From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 69CF245C9B for ; Tue, 12 Nov 2024 23:09:04 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 5D20B4064C; Tue, 12 Nov 2024 23:09:04 +0100 (CET) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mails.dpdk.org (Postfix) with ESMTP id 2DE5040A67 for ; Tue, 12 Nov 2024 23:09:03 +0100 (CET) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4319399a411so59038145e9.2 for ; Tue, 12 Nov 2024 14:09:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1731449343; x=1732054143; darn=dpdk.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=M3xrnWypvhgvqilYAw5r2T91f4fA5jjXCjZqFEmrX/A=; b=RWD6ke90EyE//Bk9kn0KlGbx+so1OOvhp7BTtdBuy4+K56Q9N8unwRU9oQwnv+hxUE lcW4WLQP+2wBm6Pk16UiT3nzMB+3ihoWq5fV8/MUMzyuKXib1zaQNZyX8IpNHhCA9n6y EPEw70kwemIzKQn5pIDs59BRYyLFEtTxuit7aFKX858CANFCSRSGQ8kRxjO9ZsVjZh7N ygkxl78fpu4C2fnNByxKV8ZZGBqR7n+BLgVcQKgkwy50nLYppP4bdat2OHR3gxMchNO+ cZesIei70eE/TS2HEJf4fkGbrIFI0/jurFo2o/8rH8TNU8rjrsZPXvOpXmk1q2oqLlyT 5ePg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1731449343; x=1732054143; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=M3xrnWypvhgvqilYAw5r2T91f4fA5jjXCjZqFEmrX/A=; b=HkOrnj3CVD6RwIBEx/9tOSWKfQXPqBbo4uCDpJTNyKBdbVojZ8ukKAh6EwNbfv+kSy bv0QxFojCXGk5+3FMa3JveWapwUAxpppBvEIphR2bssoktKTkeo0/Qv+3Jn5Pl3Pm3XW uuS7rCmVrjf2J/kyodr+W5uuMDhpMuFtYWcuuUIIvHg9UgJ3g2VPMpCX6P7/CS9Ad8Lv UYBEgEkF3IFBatAIsK2EWzxI4usSicdWxlio/lbHYCgOKLSI21rXSeQQ8DkQmVDEmEPR /7XQtYlb3tVqL8jV/06YNgpElNR2C0njv4jTHeCWdXsD5+i5pZjNrpm+7tnALuDA7dNt q9PA== X-Forwarded-Encrypted: i=1; AJvYcCXYgx4TIPTbmJQI3cLdPTNYG1MDInRZo5k7s2cRrMzL/QudFRDqE4qVtCDxmPJXgOZ7nmUHBfA=@dpdk.org X-Gm-Message-State: AOJu0YwwWymKsiEvEoljmPlYEWERfi0oAfDY7eXsOsHOQju2EMa0eHmm d1lTyN2n2Y0+oAZmQiaEmUW7dbDFrRz59BoPQSsHiZG2/L1LBKOP X-Google-Smtp-Source: AGHT+IHkllOm1ww6QMVUdATXmaUV7+CqbbGs/1XApvzygZKIp9RmJ0hbe0fuek91bSdHQquk7JWRTw== X-Received: by 2002:a05:600c:4f09:b0:42e:93af:61c5 with SMTP id 5b1f17b1804b1-432b7501fdemr163587615e9.14.1731449342580; Tue, 12 Nov 2024 14:09:02 -0800 (PST) Received: from localhost ([2a01:4b00:d036:ae00:e89d:e9a1:da72:2f9d]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-381ed9f8827sm16804123f8f.72.2024.11.12.14.09.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Nov 2024 14:09:02 -0800 (PST) From: luca.boccassi@gmail.com To: Konstantin Ananyev Cc: Stephen Hemminger , dpdk stable Subject: patch 'examples/l3fwd: fix read beyond boundaries' has been queued to stable release 22.11.7 Date: Tue, 12 Nov 2024 22:07:28 +0000 Message-ID: <20241112220754.666489-18-luca.boccassi@gmail.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20241112220754.666489-1-luca.boccassi@gmail.com> References: <20241023211704.1216956-79-luca.boccassi@gmail.com> <20241112220754.666489-1-luca.boccassi@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Hi, FYI, your patch has been queued to stable release 22.11.7 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 11/14/24. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://github.com/bluca/dpdk-stable This queued commit can be viewed at: https://github.com/bluca/dpdk-stable/commit/b619762f12ab145b2b9fd2225bcab82615bc4387 Thanks. Luca Boccassi --- >From b619762f12ab145b2b9fd2225bcab82615bc4387 Mon Sep 17 00:00:00 2001 From: Konstantin Ananyev Date: Thu, 7 Nov 2024 13:50:51 -0500 Subject: [PATCH] examples/l3fwd: fix read beyond boundaries [ upstream commit ebab0e8b2257aa049dd35dedc7efd230b0f45b88 ] ASAN report: ERROR: AddressSanitizer: unknown-crash on address 0x7ffffef92e32 at pc 0x00000053d1e9 bp 0x7ffffef92c00 sp 0x7ffffef92bf8 READ of size 16 at 0x7ffffef92e32 thread T0 #0 0x53d1e8 in _mm_loadu_si128 /usr/lib64/gcc/x86_64-suse-linux/11/include/emmintrin.h:703 #1 0x53d1e8 in send_packets_multi ../examples/l3fwd/l3fwd_sse.h:125 #2 0x53d1e8 in acl_send_packets ../examples/l3fwd/l3fwd_acl.c:1048 #3 0x53ec18 in acl_main_loop ../examples/l3fwd/l3fwd_acl.c:1127 #4 0x12151eb in rte_eal_mp_remote_launch ../lib/eal/common/eal_common_launch.c:83 #5 0x5bf2df in main ../examples/l3fwd/main.c:1647 #6 0x7f6d42a0d2bc in __libc_start_main (/lib64/libc.so.6+0x352bc) #7 0x527499 in _start (/home/kananyev/dpdk-l3fwd-acl/x86_64-native-linuxapp-gcc-dbg-b1/examples/dpdk-l3fwd+0x527499) Reason for that is that send_packets_multi() uses 16B loads to access input dst_port[]and might read beyond array boundaries. Right now, it doesn't cause any real issue - junk values are ignored, also inside l3fwd we always allocate dst_port[] array on the stack, so memory beyond it is always available. Anyway, it probably need to be fixed. The patch below simply allocates extra space for dst_port[], so send_packets_multi() will never read beyond its boundaries. Probably a better fix would be to change send_packets_multi() itself to avoid access beyond 'nb_rx' entries. Bugzilla ID: 1502 Fixes: 94c54b4158d5 ("examples/l3fwd: rework exact-match") Signed-off-by: Konstantin Ananyev Acked-by: Stephen Hemminger --- .mailmap | 2 +- examples/l3fwd/l3fwd_altivec.h | 6 +++++- examples/l3fwd/l3fwd_common.h | 7 +++++++ examples/l3fwd/l3fwd_em_hlm.h | 2 +- examples/l3fwd/l3fwd_em_sequential.h | 2 +- examples/l3fwd/l3fwd_fib.c | 2 +- examples/l3fwd/l3fwd_lpm_altivec.h | 2 +- examples/l3fwd/l3fwd_lpm_neon.h | 2 +- examples/l3fwd/l3fwd_lpm_sse.h | 2 +- examples/l3fwd/l3fwd_neon.h | 6 +++++- examples/l3fwd/l3fwd_sse.h | 6 +++++- 11 files changed, 29 insertions(+), 10 deletions(-) diff --git a/.mailmap b/.mailmap index 025bd2daba..ce3f357292 100644 --- a/.mailmap +++ b/.mailmap @@ -737,7 +737,7 @@ Kirill Rybalchenko Kishore Padmanabha Klaus Degner Kommula Shiva Shankar -Konstantin Ananyev +Konstantin Ananyev Krishna Murthy Krzysztof Galazka Krzysztof Kanas diff --git a/examples/l3fwd/l3fwd_altivec.h b/examples/l3fwd/l3fwd_altivec.h index e45e138e59..b91a6b5587 100644 --- a/examples/l3fwd/l3fwd_altivec.h +++ b/examples/l3fwd/l3fwd_altivec.h @@ -11,6 +11,9 @@ #include "altivec/port_group.h" #include "l3fwd_common.h" +#undef SENDM_PORT_OVERHEAD +#define SENDM_PORT_OVERHEAD(x) ((x) + 2 * FWDSTEP) + /* * Update source and destination MAC addresses in the ethernet header. * Perform RFC1812 checks and updates for IPV4 packets. @@ -117,7 +120,8 @@ process_packet(struct rte_mbuf *pkt, uint16_t *dst_port) */ static __rte_always_inline void send_packets_multi(struct lcore_conf *qconf, struct rte_mbuf **pkts_burst, - uint16_t dst_port[MAX_PKT_BURST], int nb_rx) + uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)], + int nb_rx) { int32_t k; int j = 0; diff --git a/examples/l3fwd/l3fwd_common.h b/examples/l3fwd/l3fwd_common.h index 224b1c08e8..d94e5f1357 100644 --- a/examples/l3fwd/l3fwd_common.h +++ b/examples/l3fwd/l3fwd_common.h @@ -18,6 +18,13 @@ /* Minimum value of IPV4 total length (20B) in network byte order. */ #define IPV4_MIN_LEN_BE (sizeof(struct rte_ipv4_hdr) << 8) +/* + * send_packet_multi() specific number of dest ports + * due to implementation we need to allocate array bigger then + * actual max number of elements in the array. + */ +#define SENDM_PORT_OVERHEAD(x) (x) + /* * From http://www.rfc-editor.org/rfc/rfc1812.txt section 5.2.2: * - The IP version number must be 4. diff --git a/examples/l3fwd/l3fwd_em_hlm.h b/examples/l3fwd/l3fwd_em_hlm.h index 2e11eefad7..db9a212e05 100644 --- a/examples/l3fwd/l3fwd_em_hlm.h +++ b/examples/l3fwd/l3fwd_em_hlm.h @@ -249,7 +249,7 @@ static inline void l3fwd_em_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint16_t portid, struct lcore_conf *qconf) { - uint16_t dst_port[MAX_PKT_BURST]; + uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)]; l3fwd_em_process_packets(nb_rx, pkts_burst, dst_port, portid, qconf, 0); send_packets_multi(qconf, pkts_burst, dst_port, nb_rx); diff --git a/examples/l3fwd/l3fwd_em_sequential.h b/examples/l3fwd/l3fwd_em_sequential.h index 067f23889a..3a40b2e434 100644 --- a/examples/l3fwd/l3fwd_em_sequential.h +++ b/examples/l3fwd/l3fwd_em_sequential.h @@ -79,7 +79,7 @@ l3fwd_em_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint16_t portid, struct lcore_conf *qconf) { int32_t i, j; - uint16_t dst_port[MAX_PKT_BURST]; + uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)]; if (nb_rx > 0) { rte_prefetch0(rte_pktmbuf_mtod(pkts_burst[0], diff --git a/examples/l3fwd/l3fwd_fib.c b/examples/l3fwd/l3fwd_fib.c index 10fa121942..5e398f8ce2 100644 --- a/examples/l3fwd/l3fwd_fib.c +++ b/examples/l3fwd/l3fwd_fib.c @@ -121,7 +121,7 @@ fib_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, { uint32_t ipv4_arr[nb_rx]; uint8_t ipv6_arr[nb_rx][RTE_FIB6_IPV6_ADDR_SIZE]; - uint16_t hops[nb_rx]; + uint16_t hops[SENDM_PORT_OVERHEAD(nb_rx)]; uint64_t hopsv4[nb_rx], hopsv6[nb_rx]; uint8_t type_arr[nb_rx]; uint32_t ipv4_cnt = 0, ipv6_cnt = 0; diff --git a/examples/l3fwd/l3fwd_lpm_altivec.h b/examples/l3fwd/l3fwd_lpm_altivec.h index adb82f1478..91aad5c313 100644 --- a/examples/l3fwd/l3fwd_lpm_altivec.h +++ b/examples/l3fwd/l3fwd_lpm_altivec.h @@ -145,7 +145,7 @@ static inline void l3fwd_lpm_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint8_t portid, struct lcore_conf *qconf) { - uint16_t dst_port[MAX_PKT_BURST]; + uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)]; l3fwd_lpm_process_packets(nb_rx, pkts_burst, portid, dst_port, qconf, 0); diff --git a/examples/l3fwd/l3fwd_lpm_neon.h b/examples/l3fwd/l3fwd_lpm_neon.h index 2a68c4c15e..3c1f827424 100644 --- a/examples/l3fwd/l3fwd_lpm_neon.h +++ b/examples/l3fwd/l3fwd_lpm_neon.h @@ -171,7 +171,7 @@ static inline void l3fwd_lpm_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint16_t portid, struct lcore_conf *qconf) { - uint16_t dst_port[MAX_PKT_BURST]; + uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)]; l3fwd_lpm_process_packets(nb_rx, pkts_burst, portid, dst_port, qconf, 0); diff --git a/examples/l3fwd/l3fwd_lpm_sse.h b/examples/l3fwd/l3fwd_lpm_sse.h index db15030320..50f1abbd8a 100644 --- a/examples/l3fwd/l3fwd_lpm_sse.h +++ b/examples/l3fwd/l3fwd_lpm_sse.h @@ -129,7 +129,7 @@ static inline void l3fwd_lpm_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint16_t portid, struct lcore_conf *qconf) { - uint16_t dst_port[MAX_PKT_BURST]; + uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)]; l3fwd_lpm_process_packets(nb_rx, pkts_burst, portid, dst_port, qconf, 0); diff --git a/examples/l3fwd/l3fwd_neon.h b/examples/l3fwd/l3fwd_neon.h index 40807d5965..bc2bab8265 100644 --- a/examples/l3fwd/l3fwd_neon.h +++ b/examples/l3fwd/l3fwd_neon.h @@ -10,6 +10,9 @@ #include "neon/port_group.h" #include "l3fwd_common.h" +#undef SENDM_PORT_OVERHEAD +#define SENDM_PORT_OVERHEAD(x) ((x) + 2 * FWDSTEP) + /* * Update source and destination MAC addresses in the ethernet header. * Perform RFC1812 checks and updates for IPV4 packets. @@ -92,7 +95,8 @@ process_packet(struct rte_mbuf *pkt, uint16_t *dst_port) */ static __rte_always_inline void send_packets_multi(struct lcore_conf *qconf, struct rte_mbuf **pkts_burst, - uint16_t dst_port[MAX_PKT_BURST], int nb_rx) + uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)], + int nb_rx) { int32_t k; int j = 0; diff --git a/examples/l3fwd/l3fwd_sse.h b/examples/l3fwd/l3fwd_sse.h index 083729cdef..6236b7873c 100644 --- a/examples/l3fwd/l3fwd_sse.h +++ b/examples/l3fwd/l3fwd_sse.h @@ -10,6 +10,9 @@ #include "sse/port_group.h" #include "l3fwd_common.h" +#undef SENDM_PORT_OVERHEAD +#define SENDM_PORT_OVERHEAD(x) ((x) + 2 * FWDSTEP) + /* * Update source and destination MAC addresses in the ethernet header. * Perform RFC1812 checks and updates for IPV4 packets. @@ -91,7 +94,8 @@ process_packet(struct rte_mbuf *pkt, uint16_t *dst_port) */ static __rte_always_inline void send_packets_multi(struct lcore_conf *qconf, struct rte_mbuf **pkts_burst, - uint16_t dst_port[MAX_PKT_BURST], int nb_rx) + uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)], + int nb_rx) { int32_t k; int j = 0; -- 2.45.2 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2024-11-12 22:06:59.265082048 +0000 +++ 0018-examples-l3fwd-fix-read-beyond-boundaries.patch 2024-11-12 22:06:58.663307139 +0000 @@ -1 +1 @@ -From ebab0e8b2257aa049dd35dedc7efd230b0f45b88 Mon Sep 17 00:00:00 2001 +From b619762f12ab145b2b9fd2225bcab82615bc4387 Mon Sep 17 00:00:00 2001 @@ -5,0 +6,2 @@ +[ upstream commit ebab0e8b2257aa049dd35dedc7efd230b0f45b88 ] + @@ -32 +33,0 @@ -Cc: stable@dpdk.org @@ -38 +38,0 @@ - examples/l3fwd/l3fwd_acl.c | 2 +- @@ -49 +49 @@ - 12 files changed, 30 insertions(+), 11 deletions(-) + 11 files changed, 29 insertions(+), 10 deletions(-) @@ -52 +52 @@ -index 4894219f2f..4eef08df30 100644 +index 025bd2daba..ce3f357292 100644 @@ -55 +55 @@ -@@ -804,7 +804,7 @@ Kirill Rybalchenko +@@ -737,7 +737,7 @@ Kirill Rybalchenko @@ -64,13 +63,0 @@ -diff --git a/examples/l3fwd/l3fwd_acl.c b/examples/l3fwd/l3fwd_acl.c -index b635011ef7..baa01e6dde 100644 ---- a/examples/l3fwd/l3fwd_acl.c -+++ b/examples/l3fwd/l3fwd_acl.c -@@ -1056,7 +1056,7 @@ int - acl_main_loop(__rte_unused void *dummy) - { - struct rte_mbuf *pkts_burst[MAX_PKT_BURST]; -- uint16_t hops[MAX_PKT_BURST]; -+ uint16_t hops[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)]; - unsigned int lcore_id; - uint64_t prev_tsc, diff_tsc, cur_tsc; - int i, nb_rx; @@ -120 +107 @@ -index 31cda9ddc1..c1d819997a 100644 +index 2e11eefad7..db9a212e05 100644 @@ -146 +133 @@ -index a0eef05a5d..e1eb8c61c8 100644 +index 10fa121942..5e398f8ce2 100644 @@ -152 +139 @@ - struct rte_ipv6_addr ipv6_arr[nb_rx]; + uint8_t ipv6_arr[nb_rx][RTE_FIB6_IPV6_ADDR_SIZE];