From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-bounces@dpdk.org>
Received: from mails.dpdk.org (unknown [217.70.189.124])
	by inbox.dpdk.org (Postfix) with ESMTP id 40736460A5
	for <public@inbox.dpdk.org>; Thu, 16 Jan 2025 23:52:17 +0100 (CET)
Received: from mails.dpdk.org (localhost [127.0.0.1])
	by mails.dpdk.org (Postfix) with ESMTP id A22DE410DF;
	Thu, 16 Jan 2025 23:51:59 +0100 (CET)
Received: from mail-ej1-f98.google.com (mail-ej1-f98.google.com
 [209.85.218.98]) by mails.dpdk.org (Postfix) with ESMTP id 991E5410D0
 for <stable@dpdk.org>; Thu, 16 Jan 2025 23:51:58 +0100 (CET)
Received: by mail-ej1-f98.google.com with SMTP id
 a640c23a62f3a-ab2aea81cd8so250933466b.2
 for <stable@dpdk.org>; Thu, 16 Jan 2025 14:51:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=6wind.com; s=google; t=1737067918; x=1737672718; darn=dpdk.org;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:from:to:cc:subject:date
 :message-id:reply-to;
 bh=/n2fLuTtbT4OjeQzAmtX52s/dppE3x4lTnbeqj/XXCQ=;
 b=aGTCJhKTAeeajKBQRrSPs5JSxINe5b/KoO3DAExGpIJqUxbqZFKXRZ1LEYHTFP0H26
 I4EzgvQSBMPlEb9THGK0i1G0MQtIZBV0xrNIbFRuLeGEh6nKE5MQtWdiRk8tF+LK0fW+
 yRKtYiLP3bA6FGIAFWfFaoqeE9H+g16AWdP4I4GlaOtfytS8TeLaeog2v7XqSynUF3xU
 gQvHz5ERjIFaoKGCSod4zP0l7GmT15kn1U5EpaG+BTC3m4/h/2kQyQZ8FPZY6j8ma73V
 2MrxeyeJg07Kp//1btTJFl3zxgsGSNOC9cV+MCkyNTGbHYgrtv+3U583Ud++sBc5fCF6
 IRwA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1737067918; x=1737672718;
 h=content-transfer-encoding:mime-version:references:in-reply-to
 :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc
 :subject:date:message-id:reply-to;
 bh=/n2fLuTtbT4OjeQzAmtX52s/dppE3x4lTnbeqj/XXCQ=;
 b=TkrLpb0HcRG5ZlSq2NW/+6dj/TlJSyZ7xCbJo3lnM9MG6X60OylZkBTnZ7wpHTH6bE
 cS8B9GH2ozJpTL9ds4dyUx/DeGKTVRrn7ShfyYe4kM1dwpOptVRDLHcbo2aIj7Q5UvB7
 Z8X8SQ5jLhieu7YOMrq/68+3GVSbw4/s7ngD227mLIunitdh9l7fyMUHb2SQXCVAQg8O
 Y63O1QcOWKrdhY77wXIHMg8dgCm5KAye3X+ytJ9tDMm3gcVS0HHUBMcjiSd4s0zdIV72
 lO0ItHJ2qbpbyOrmNz1/MRcOqtgt8ubQWSaI1+0PCwvZzG99wifmy5TQLLonu7+VcSaE
 6ECw==
X-Gm-Message-State: AOJu0YzGNubvRWVi0LD/Xsl/QCCtG/CV05FHQO4GWucDKaraGh5LLC4L
 ybOTKGr4uvA4J7AcvrSLpOvWuG6xNJGvBSoNoaREnEHkIp8RTPOW8dUr2cilogERfdly9UdazvF
 KsURtRUeEe8WVnS5wd3JjWT0Wvj2B+Gm2
X-Gm-Gg: ASbGnct0f+598yRfqVhLQlbTYErMbG1igrLP3kiCkWBqrPdkzQa6yn5IO6XdYUZSOrE
 nTl929oNJMEYoxsgCq+86LVvfWE460S9xa9FJVLCAnDWO4Qt1u5ry3/QJ/28RRYn3/zoiJDcxI9
 5PyedX7l+31m1X8VnUAs0GwYM1MGkoAO5CbY4Y/6bmilUlsMoTKxOnpEmYMjJEvhLyUeH6zrkZt
 /F+qsw5zuw1ce4zbSjTS3D8hkGXnQCRXH52PWdgJ/kumxQl6g0QpqNQT+WhkhPPTohhHRTAILnx
 oSiuj+Ox6xrxnydTKdNlpMbR3g==
X-Google-Smtp-Source: AGHT+IHjCxzm4yVnwJyEY/UkBc5vkOBP1V8hIs9lCtUlJ/EKCCyLkbSNwdNkmfOF+wB0aGG7Z30cacB3A5Pk
X-Received: by 2002:a17:907:7291:b0:aaf:3f57:9d2e with SMTP id
 a640c23a62f3a-ab38ad88887mr50724066b.0.1737067918271; 
 Thu, 16 Jan 2025 14:51:58 -0800 (PST)
Received: from smtpservice.6wind.com ([185.13.181.2])
 by smtp-relay.gmail.com with ESMTP id
 a640c23a62f3a-ab385263558sm2301166b.167.2025.01.16.14.51.58; 
 Thu, 16 Jan 2025 14:51:58 -0800 (PST)
X-Relaying-Domain: 6wind.com
Received: from localhost (rainbow.dev.6wind.com [10.17.1.165])
 by smtpservice.6wind.com (Postfix) with ESMTP id 1F22411D48;
 Thu, 16 Jan 2025 23:51:58 +0100 (CET)
From: Ariel Otilibili <ariel.otilibili@6wind.com>
To: dev@dpdk.org
Cc: stable@dpdk.org, Stephen Hemminger <stephen@networkplumber.org>,
 Thomas Monjalon <thomas@monjalon.net>,
 David Marchand <david.marchand@redhat.com>,
 Ariel Otilibili <ariel.otilibili@6wind.com>,
 Ciara Loftus <ciara.loftus@intel.com>, Maryam Tahhan <mtahhan@redhat.com>
Subject: [PATCH v2 1/2] net/af_xdp: fix use after free in af_xdp_tx_zc()
Date: Thu, 16 Jan 2025 23:51:50 +0100
Message-Id: <20250116225151.188214-2-ariel.otilibili@6wind.com>
X-Mailer: git-send-email 2.30.2
In-Reply-To: <20250116225151.188214-1-ariel.otilibili@6wind.com>
References: <20250116195640.68885-1-ariel.otilibili@6wind.com>
 <20250116225151.188214-1-ariel.otilibili@6wind.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-BeenThere: stable@dpdk.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: patches for DPDK stable branches <stable.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/stable>,
 <mailto:stable-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/stable/>
List-Post: <mailto:stable@dpdk.org>
List-Help: <mailto:stable-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/stable>,
 <mailto:stable-request@dpdk.org?subject=subscribe>
Errors-To: stable-bounces@dpdk.org

tx_bytes is computed after both legs are tested. This might
produce a use after memory free.

The computation is now moved into each leg.

Bugzilla ID: 1440
Fixes: d8a210774e1d ("net/af_xdp: support unaligned umem chunks")
Signed-off-by: Ariel Otilibili <ariel.otilibili@6wind.com>
---
 drivers/net/af_xdp/rte_eth_af_xdp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/af_xdp/rte_eth_af_xdp.c b/drivers/net/af_xdp/rte_eth_af_xdp.c
index 814398ba4b44..4326a29f7042 100644
--- a/drivers/net/af_xdp/rte_eth_af_xdp.c
+++ b/drivers/net/af_xdp/rte_eth_af_xdp.c
@@ -574,6 +574,7 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 					umem->mb_pool->header_size;
 			offset = offset << XSK_UNALIGNED_BUF_OFFSET_SHIFT;
 			desc->addr = addr | offset;
+			tx_bytes += mbuf->pkt_len;
 			count++;
 		} else {
 			struct rte_mbuf *local_mbuf =
@@ -601,11 +602,10 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
 			desc->addr = addr | offset;
 			rte_memcpy(pkt, rte_pktmbuf_mtod(mbuf, void *),
 					desc->len);
+			tx_bytes += mbuf->pkt_len;
 			rte_pktmbuf_free(mbuf);
 			count++;
 		}
-
-		tx_bytes += mbuf->pkt_len;
 	}
 
 out:
-- 
2.30.2