Skip to content

Commit ebab0e8

Browse files
Konstantin Ananyevtmonjalo
Konstantin Ananyev
authored and
tmonjalo
committed
examples/l3fwd: fix read beyond boundaries
ASAN report: ERROR: AddressSanitizer: unknown-crash on address 0x7ffffef92e32 at pc 0x00000053d1e9 bp 0x7ffffef92c00 sp 0x7ffffef92bf8 READ of size 16 at 0x7ffffef92e32 thread T0 #0 0x53d1e8 in _mm_loadu_si128 /usr/lib64/gcc/x86_64-suse-linux/11/include/emmintrin.h:703 #1 0x53d1e8 in send_packets_multi ../examples/l3fwd/l3fwd_sse.h:125 #2 0x53d1e8 in acl_send_packets ../examples/l3fwd/l3fwd_acl.c:1048 #3 0x53ec18 in acl_main_loop ../examples/l3fwd/l3fwd_acl.c:1127 #4 0x12151eb in rte_eal_mp_remote_launch ../lib/eal/common/eal_common_launch.c:83 DPDK#5 0x5bf2df in main ../examples/l3fwd/main.c:1647 DPDK#6 0x7f6d42a0d2bc in __libc_start_main (/lib64/libc.so.6+0x352bc) DPDK#7 0x527499 in _start (/home/kananyev/dpdk-l3fwd-acl/x86_64-native-linuxapp-gcc-dbg-b1/examples/dpdk-l3fwd+0x527499) Reason for that is that send_packets_multi() uses 16B loads to access input dst_port[]and might read beyond array boundaries. Right now, it doesn't cause any real issue - junk values are ignored, also inside l3fwd we always allocate dst_port[] array on the stack, so memory beyond it is always available. Anyway, it probably need to be fixed. The patch below simply allocates extra space for dst_port[], so send_packets_multi() will never read beyond its boundaries. Probably a better fix would be to change send_packets_multi() itself to avoid access beyond 'nb_rx' entries. Bugzilla ID: 1502 Fixes: 94c54b4 ("examples/l3fwd: rework exact-match") Cc: [email protected] Signed-off-by: Konstantin Ananyev <[email protected]> Acked-by: Stephen Hemminger <[email protected]>
1 parent 89398ec commit ebab0e8

12 files changed

+30
-11
lines changed

‎.mailmap

+1-1
Original file line numberDiff line numberDiff line change
@@ -804,7 +804,7 @@ Kirill Rybalchenko <[email protected]>
804804
Kishore Padmanabha <[email protected]>
805805
Klaus Degner <[email protected]>
806806
Kommula Shiva Shankar <[email protected]>
807-
Konstantin Ananyev <konstantin.v.ananyev@yandex.ru> <konstantin.ananyev@huawei.com> <[email protected]>
807+
Konstantin Ananyev <konstantin.ananyev@huawei.com> <konstantin.v.ananyev@yandex.ru> <[email protected]>
808808
Krishna Murthy <[email protected]>
809809
Krzysztof Galazka <[email protected]>
810810
Krzysztof Kanas <[email protected]> <[email protected]>

‎examples/l3fwd/l3fwd_acl.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -1056,7 +1056,7 @@ int
10561056
acl_main_loop(__rte_unused void *dummy)
10571057
{
10581058
struct rte_mbuf *pkts_burst[MAX_PKT_BURST];
1059-
uint16_t hops[MAX_PKT_BURST];
1059+
uint16_t hops[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)];
10601060
unsigned int lcore_id;
10611061
uint64_t prev_tsc, diff_tsc, cur_tsc;
10621062
int i, nb_rx;

‎examples/l3fwd/l3fwd_altivec.h

+5-1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,9 @@
1111
#include "altivec/port_group.h"
1212
#include "l3fwd_common.h"
1313

14+
#undef SENDM_PORT_OVERHEAD
15+
#define SENDM_PORT_OVERHEAD(x) ((x) + 2 * FWDSTEP)
16+
1417
/*
1518
* Update source and destination MAC addresses in the ethernet header.
1619
* Perform RFC1812 checks and updates for IPV4 packets.
@@ -117,7 +120,8 @@ process_packet(struct rte_mbuf *pkt, uint16_t *dst_port)
117120
*/
118121
static __rte_always_inline void
119122
send_packets_multi(struct lcore_conf *qconf, struct rte_mbuf **pkts_burst,
120-
uint16_t dst_port[MAX_PKT_BURST], int nb_rx)
123+
uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)],
124+
int nb_rx)
121125
{
122126
int32_t k;
123127
int j = 0;

‎examples/l3fwd/l3fwd_common.h

+7
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,13 @@
1818
/* Minimum value of IPV4 total length (20B) in network byte order. */
1919
#define IPV4_MIN_LEN_BE (sizeof(struct rte_ipv4_hdr) << 8)
2020

21+
/*
22+
* send_packet_multi() specific number of dest ports
23+
* due to implementation we need to allocate array bigger then
24+
* actual max number of elements in the array.
25+
*/
26+
#define SENDM_PORT_OVERHEAD(x) (x)
27+
2128
/*
2229
* From http://www.rfc-editor.org/rfc/rfc1812.txt section 5.2.2:
2330
* - The IP version number must be 4.

‎examples/l3fwd/l3fwd_em_hlm.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ static inline void
249249
l3fwd_em_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint16_t portid,
250250
struct lcore_conf *qconf)
251251
{
252-
uint16_t dst_port[MAX_PKT_BURST];
252+
uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)];
253253

254254
l3fwd_em_process_packets(nb_rx, pkts_burst, dst_port, portid, qconf, 0);
255255
send_packets_multi(qconf, pkts_burst, dst_port, nb_rx);

‎examples/l3fwd/l3fwd_em_sequential.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ l3fwd_em_send_packets(int nb_rx, struct rte_mbuf **pkts_burst,
7979
uint16_t portid, struct lcore_conf *qconf)
8080
{
8181
int32_t i, j;
82-
uint16_t dst_port[MAX_PKT_BURST];
82+
uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)];
8383

8484
if (nb_rx > 0) {
8585
rte_prefetch0(rte_pktmbuf_mtod(pkts_burst[0],

‎examples/l3fwd/l3fwd_fib.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ fib_send_packets(int nb_rx, struct rte_mbuf **pkts_burst,
121121
{
122122
uint32_t ipv4_arr[nb_rx];
123123
struct rte_ipv6_addr ipv6_arr[nb_rx];
124-
uint16_t hops[nb_rx];
124+
uint16_t hops[SENDM_PORT_OVERHEAD(nb_rx)];
125125
uint64_t hopsv4[nb_rx], hopsv6[nb_rx];
126126
uint8_t type_arr[nb_rx];
127127
uint32_t ipv4_cnt = 0, ipv6_cnt = 0;

‎examples/l3fwd/l3fwd_lpm_altivec.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ static inline void
145145
l3fwd_lpm_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint8_t portid,
146146
struct lcore_conf *qconf)
147147
{
148-
uint16_t dst_port[MAX_PKT_BURST];
148+
uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)];
149149

150150
l3fwd_lpm_process_packets(nb_rx, pkts_burst, portid, dst_port, qconf,
151151
0);

‎examples/l3fwd/l3fwd_lpm_neon.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ static inline void
171171
l3fwd_lpm_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint16_t portid,
172172
struct lcore_conf *qconf)
173173
{
174-
uint16_t dst_port[MAX_PKT_BURST];
174+
uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)];
175175

176176
l3fwd_lpm_process_packets(nb_rx, pkts_burst, portid, dst_port, qconf,
177177
0);

‎examples/l3fwd/l3fwd_lpm_sse.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@ static inline void
129129
l3fwd_lpm_send_packets(int nb_rx, struct rte_mbuf **pkts_burst, uint16_t portid,
130130
struct lcore_conf *qconf)
131131
{
132-
uint16_t dst_port[MAX_PKT_BURST];
132+
uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)];
133133

134134
l3fwd_lpm_process_packets(nb_rx, pkts_burst, portid, dst_port, qconf,
135135
0);

‎examples/l3fwd/l3fwd_neon.h

+5-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010
#include "neon/port_group.h"
1111
#include "l3fwd_common.h"
1212

13+
#undef SENDM_PORT_OVERHEAD
14+
#define SENDM_PORT_OVERHEAD(x) ((x) + 2 * FWDSTEP)
15+
1316
/*
1417
* Update source and destination MAC addresses in the ethernet header.
1518
* Perform RFC1812 checks and updates for IPV4 packets.
@@ -92,7 +95,8 @@ process_packet(struct rte_mbuf *pkt, uint16_t *dst_port)
9295
*/
9396
static __rte_always_inline void
9497
send_packets_multi(struct lcore_conf *qconf, struct rte_mbuf **pkts_burst,
95-
uint16_t dst_port[MAX_PKT_BURST], int nb_rx)
98+
uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)],
99+
int nb_rx)
96100
{
97101
int32_t k;
98102
int j = 0;

‎examples/l3fwd/l3fwd_sse.h

+5-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010
#include "sse/port_group.h"
1111
#include "l3fwd_common.h"
1212

13+
#undef SENDM_PORT_OVERHEAD
14+
#define SENDM_PORT_OVERHEAD(x) ((x) + 2 * FWDSTEP)
15+
1316
/*
1417
* Update source and destination MAC addresses in the ethernet header.
1518
* Perform RFC1812 checks and updates for IPV4 packets.
@@ -91,7 +94,8 @@ process_packet(struct rte_mbuf *pkt, uint16_t *dst_port)
9194
*/
9295
static __rte_always_inline void
9396
send_packets_multi(struct lcore_conf *qconf, struct rte_mbuf **pkts_burst,
94-
uint16_t dst_port[MAX_PKT_BURST], int nb_rx)
97+
uint16_t dst_port[SENDM_PORT_OVERHEAD(MAX_PKT_BURST)],
98+
int nb_rx)
9599
{
96100
int32_t k;
97101
int j = 0;

0 commit comments

Comments
 (0)