Bug 1403 - PMD: IDPF segfaults during init on GCP baremetal
Summary: PMD: IDPF segfaults during init on GCP baremetal
Status: UNCONFIRMED
Alias: None
Product: DPDK
Classification: Unclassified
Component: ethdev (show other bugs)
Version: 23.11
Hardware: x86 Linux
: Normal normal
Target Milestone: ---
Assignee: dev
URL:
Depends on:
Blocks:
 
Reported: 2024-03-14 21:41 CET by Jordan Rhee
Modified: 2024-03-14 21:42 CET (History)
1 user (show)



Attachments

Description Jordan Rhee 2024-03-14 21:41:52 CET
The DPDK IDPF driver (as of 23.11) segfaults during initialization while handling response to `VIRTCHNL2_OP_SET_RSS_HASH` message.


Segfault is due to load from invalid address contained in `ctlq_msg.ctx.indirect.payload`. 


```
idpf_handle_virtchnl_msg()
...
rte_memcpy(adapter->mbx_resp, ctlq_msg.ctx.indirect.payload->va,
			   IDPF_DFLT_MBX_BUF_SIZE);
```


`payload` only contains a valid address if the message is an 'indirect' message. It is not valid if it is a 'direct' message. If `ctlq_msg.data_len` is 0, then it is a direct message and the caller should not access `ctlq_msg.ctx.indirect`. `VIRTCHNL2_OP_SET_RSS_HASH` has a zero-length response.


The following patch enables the DPDK IDPF driver to load and run successfully:


```
diff --git a/drivers/net/idpf/idpf_ethdev.c b/drivers/net/idpf/idpf_ethdev.c
index 6ae2ac2681..c273e9ba38 100644
--- a/drivers/net/idpf/idpf_ethdev.c
+++ b/drivers/net/idpf/idpf_ethdev.c
@@ -1087,8 +1087,10 @@ idpf_handle_virtchnl_msg(struct idpf_adapter_ext *adapter_ex)
                        return;
                }
 
-               rte_memcpy(adapter->mbx_resp, ctlq_msg.ctx.indirect.payload->va,
+                if (ctlq_msg.data_len) {
+                     rte_memcpy(adapter->mbx_resp, ctlq_msg.ctx.indirect.payload->va,
                           IDPF_DFLT_MBX_BUF_SIZE);
+                }
 
                mbx_op = rte_le_to_cpu_16(ctlq_msg.opcode);
                vc_op = rte_le_to_cpu_32(ctlq_msg.cookie.mbx.chnl_opcode);
```


Stack:
```
#0  0x000000000108fc61 in idpf_handle_virtchnl_msg (adapter_ex=0x1003d7b40) at ../drivers/net/idpf/idpf_ethdev.c:1090
#1  0x00000000010912e3 in idpf_dev_alarm_handler (param=0x1003d7b40) at ../drivers/net/idpf/idpf_ethdev.c:1145
#2  0x000000000211e8fc in eal_alarm_callback (arg=0x0) at ../lib/eal/linux/eal_alarm.c:105
#3  0x0000000002123c3d in eal_intr_process_interrupts (events=0x7f4a69a052e0, nfds=1) at ../lib/eal/linux/eal_interrupts.c:1017
#4  0x0000000002123f1c in eal_intr_handle_interrupts (pfd=6, totalfds=3) at ../lib/eal/linux/eal_interrupts.c:1091
#5  0x00000000021240ee in eal_intr_thread_main (arg=0x0) at ../lib/eal/linux/eal_interrupts.c:1163
#6  0x0000000002103bc4 in control_thread_start (arg=0x90c4f00) at ../lib/eal/common/eal_common_thread.c:282
#7  0x000000000211b7a0 in thread_start_wrapper (arg=0x7fff25a9c5a0) at ../lib/eal/unix/rte_thread.c:112
#8  0x00007f4a69fe96ea in start_thread () from /lib64/libpthread.so.0
#9  0x00007f4a69b2150f in clone () from /lib64/libc.so.6

(gdb) print ctlq_msg
$7 = {
  vmvf_type = 2 '\002',
  host_id = 117 'u',
  opcode = 2051,
  data_len = 0,             <--- direct message
  {
    func_id = 26624,
    status = 26624
  },
  cookie = {
    mbx = {
      chnl_opcode = 518,   <--- VIRTCHNL2_OP_SET_RSS_HASH
      chnl_retval = 0
    }
  },
  ctx = {
    direct = "\000\000\000\000\000\000\000\000x\357\336\277\374\026\000",
    indirect = {
      context = "\000\000\000\000\000\000\000",
      payload = 0x16fcbfdeef78                      <---- Invalid address
    },
    sw_cookie = {
      rsvd = 0,
      data = 0,
      flags = 0
    }
  }
}

```

Note You need to log in before you can comment on or make changes to this bug.