From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (unknown [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id BF0EA460A4 for ; Thu, 16 Jan 2025 20:57:22 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id E41B740E39; Thu, 16 Jan 2025 20:56:56 +0100 (CET) Received: from mail-ej1-f98.google.com (mail-ej1-f98.google.com [209.85.218.98]) by mails.dpdk.org (Postfix) with ESMTP id A962340E18 for ; Thu, 16 Jan 2025 20:56:53 +0100 (CET) Received: by mail-ej1-f98.google.com with SMTP id a640c23a62f3a-aa6a92f863cso260767066b.1 for ; Thu, 16 Jan 2025 11:56:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1737057413; x=1737662213; darn=dpdk.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LODOdMgykO+JdnQSIOiFbN0zFxrhoevkVTT9PrriXaw=; b=i/ynusjBO4XOb0l5UAF5t5HvTZAJNmkZP9yss/vwyhAP1cRtQvBbz2Qxefa5hJSvGf s6+Y6k9B3ySplGgILgvqUmqlpHehYM0JGBhcJrKp2p6dl5j/tRxqY8m8SLld1UD1i+kV ii6tmZY5LLIRERMBGo3mDHTba0frzqY1pB04myuNe8youaRiojUw3f6yoPUCmY+oUKkU eBAc59XYaRw0FqnbgqS1aXz1Z8rrDZBiITlAUIiMGXphfJJcnAcGtQmqjVH97y7lp53U l4jDf+a7giIn+OBMKVHf6XTrgBXQuAzclk+cy2A+twMiUqWg/fI7tGRQk26ymwthHgX5 GhFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737057413; x=1737662213; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LODOdMgykO+JdnQSIOiFbN0zFxrhoevkVTT9PrriXaw=; b=uFaG4bkK+YyV89HBbA+ChZoGxksnRdsEByF7WTqQkcAEB4KtXWFHH2BFx66R8QLti6 Mbjtlv7ijyJPJcONJJZqkTRk0rxk+QmuaL4AGu7W9uC10sg5rR7uMwGTsWvTMreJesa9 /dCVBmHaShRXXfw1oU4rp06FQza8kYisa5cSVFYW2cKYNdn7XNGhkyb7+08c+iboR5w2 nF8BqL8+wWYrm+5ZVLI55aJ8mJR1cTE9iL1D8o9UfKO0vz0YR/br0gKC98/93+QSvB6/ QIYsfZMzBxPhXyI1zeFiqPVH6FYuZcWTpuaZM+7+6Jl9T2Ggp+QNyPNU76Fw1MRa9gCI FCtw== X-Gm-Message-State: AOJu0YxQ2tOjiCy2WIAsi5EDHHcXeOKEqx+T1ddaEhkvoK5+ST3N67pi lfJo65lmjvCx4LIMaox3nzzBO3iKP/tJOZ2qvVE96MbUT9voJxzAK1rq2sPkHBixFjTqhhlixex 0LSBlnfRxAOB+m2ufUQh+zJIm3wl9zewm X-Gm-Gg: ASbGnctJoyTHC9HyQl8xn1e5GmdIy8uXuK/VEZbG2xqQ4/SUTJ+2qSpvbz3F/lCvd2s rOSwG+InB8VshhyDz3CI5bsHtVNxLC9r8YI5Dm2sd1+jShhVgkVC25CZlAzFap3IZTY97neiHgF OHB7sJbqjDgW7ZrzO+Nw9Xe6e7oWbHyz+xcQRsmCBZkwtygfpMS6NslOQVXQl1Mr8z5Ofq6NUCR 4i6RcrYvjy6+clJygJIVPaI6DPbaAuyw+NxCaqq/tGLt8nLMp1FUX01JI17qDzVm8QfEIZnNyLx WPWJSNt9pT9HFm03sSzyOF4KZQ== X-Google-Smtp-Source: AGHT+IHWWPoKkH9GeqFX3MGKSTCqEXYOnfXWp098O70VcK03IBEFH5ueZGOTYCKStDH2SpbD+VyJ1sYLk8Te X-Received: by 2002:a17:907:7205:b0:ab3:88a0:b71d with SMTP id a640c23a62f3a-ab38b2e734fmr9859366b.34.1737057413277; Thu, 16 Jan 2025 11:56:53 -0800 (PST) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id a640c23a62f3a-ab3852d4e78sm1153866b.243.2025.01.16.11.56.53; Thu, 16 Jan 2025 11:56:53 -0800 (PST) X-Relaying-Domain: 6wind.com Received: from localhost (rainbow.dev.6wind.com [10.17.1.165]) by smtpservice.6wind.com (Postfix) with ESMTP id 25F5111C78; Thu, 16 Jan 2025 20:56:53 +0100 (CET) From: Ariel Otilibili To: dev@dpdk.org Cc: stable@dpdk.org, Stephen Hemminger , Thomas Monjalon , David Marchand , Ariel Otilibili , Ciara Loftus , Maryam Tahhan Subject: [PATCH 1/2] net/af_xdp: fix use after free in af_xdp_tx_zc() Date: Thu, 16 Jan 2025 20:56:38 +0100 Message-Id: <20250116195640.68885-2-ariel.otilibili@6wind.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20250116195640.68885-1-ariel.otilibili@6wind.com> References: <20250116195640.68885-1-ariel.otilibili@6wind.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org tx_bytes is computed after both branches are tested. This might produce a use after memory free. The computation is now moved into both branches. Bugzilla ID: 1440 Fixes: d8a210774e1d ("net/af_xdp: support unaligned umem chunks") Signed-off-by: Ariel Otilibili --- drivers/net/af_xdp/rte_eth_af_xdp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/af_xdp/rte_eth_af_xdp.c b/drivers/net/af_xdp/rte_eth_af_xdp.c index 814398ba4b44..4326a29f7042 100644 --- a/drivers/net/af_xdp/rte_eth_af_xdp.c +++ b/drivers/net/af_xdp/rte_eth_af_xdp.c @@ -574,6 +574,7 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) umem->mb_pool->header_size; offset = offset << XSK_UNALIGNED_BUF_OFFSET_SHIFT; desc->addr = addr | offset; + tx_bytes += mbuf->pkt_len; count++; } else { struct rte_mbuf *local_mbuf = @@ -601,11 +602,10 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) desc->addr = addr | offset; rte_memcpy(pkt, rte_pktmbuf_mtod(mbuf, void *), desc->len); + tx_bytes += mbuf->pkt_len; rte_pktmbuf_free(mbuf); count++; } - - tx_bytes += mbuf->pkt_len; } out: -- 2.30.2