Bug 248 - Bonding PMD: Invalid array dimension in TX burst for 802.3ad mode with fast queue leads to SEGFAULT
Summary: Bonding PMD: Invalid array dimension in TX burst for 802.3ad mode with fast q...
Status: CONFIRMED
Alias: None
Product: DPDK
Classification: Unclassified
Component: ethdev (show other bugs)
Version: 18.11
Hardware: All All
: Normal major
Target Milestone: ---
Assignee: Oltar
URL:
Depends on:
Blocks:
 
Reported: 2019-04-09 16:44 CEST by Oltar
Modified: 2019-04-15 12:00 CEST (History)
2 users (show)



Attachments

Description Oltar 2019-04-09 16:44:45 CEST
DPDK 18.11.1

In drivers/net/bonding/rte_eth_bond_pmd.c::bond_ethdev_tx_burst_8023ad, bufs_slave_port_idxs array is defined as follows (lines 1293-1294):

    /* Mapping array generated by hash function to map mbufs to slaves */
    uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };

Array dimension should be equal to number of packets being transmitted (nb_pkts) - as correctly implemented in rte_eth_bond_pmd.c::bond_ethdev_tx_burst_balance.

Invalid array dimension causes overflow when number of transmitted packets is greater than RTE_MAX_ETHPORTS. Some areas of memory end up overwritten (in my particular case, slave_nb_bufs array), which leads to SIGSEGV and crash.

To work around the issue, ensure that number of packets transmitted in a single burst is no greater than RTE_MAX_ETHPORTS.

To fix it, it should be sufficient to define bufs_slave_port_idxs as a variable-length array, as in bond_ethdev_tx_burst_balance:

    /* Mapping array generated by hash function to map mbufs to slaves */
    uint16_t bufs_slave_port_idxs[nb_bufs];
Comment 1 Ajit Khaparde 2019-04-11 03:34:11 CEST
@Przemysław,
Can you confirm if David's patchset addresses the issue you are seeing?
http://patchwork.dpdk.org/project/dpdk/list/?series=4240
Comment 2 Oltar 2019-04-15 12:00:25 CEST
(In reply to Ajit Khaparde from comment #1)
> @Przemysław,
> Can you confirm if David's patchset addresses the issue you are seeing?
> http://patchwork.dpdk.org/project/dpdk/list/?series=4240

Source code analysis after applying David's patches to master indicates that patchset should solve the invalid array dimension issue.

However, I have not been able to confirm it by running our system on current DPDK, since some changes from 18.11.1 to master make it behave incorrectly.

When I have some more time I will attempt to properly migrate it and only then I can share any proper results.

Note You need to log in before you can comment on or make changes to this bug.