build/external/patches/dpdk_18.08/0006-net-bonding-fix-buffer-corruption-in-packets.patch

   1 commit 6b2a47d
   2 Author:     Jia Yu <jyu@vmware.com>
   3 AuthorDate: Sun Aug 19 22:18:45 2018 -0700
   4 Commit:     Ferruh Yigit <ferruh.yigit@intel.com>
   5 CommitDate: Tue Aug 28 15:27:39 2018 +0200
   6
   7     net/bonding: fix buffer corruption in packets
   8
   9     When bond slave devices cannot transmit all packets in bufs array,
  10     tx_burst callback shall merge the un-transmitted packets back to
  11     bufs array. Recent merge logic introduced a bug which causes
  12     invalid mbuf addresses being written to bufs array.
  13     When caller frees the un-transmitted packets, due to invalid addresses,
  14     application will crash.
  15
  16     The fix is avoid shifting mbufs, and directly write un-transmitted
  17     packets back to bufs array.
  18
  19     Fixes: 09150784a776 ("net/bonding: burst mode hash calculation")
  20     Cc: stable@dpdk.org
  21
  22     Signed-off-by: Jia Yu <jyu@vmware.com>
  23     Acked-by: Chas Williams <chas3@att.com>
  24
  25 diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c
  26 index 4417422..b84f322 100644
  27 --- a/drivers/net/bonding/rte_eth_bond_pmd.c
  28 +++ b/drivers/net/bonding/rte_eth_bond_pmd.c
  29 @@ -301,10 +301,10 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs,
  30         /* Mapping array generated by hash function to map mbufs to slaves */
  31         uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
  32
  33 -       uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
  34 +       uint16_t slave_tx_count;
  35         uint16_t total_tx_count = 0, total_tx_fail_count = 0;
  36
  37 -       uint16_t i, j;
  38 +       uint16_t i;
  39
  40         if (unlikely(nb_bufs == 0))
  41                 return 0;
  42 @@ -359,34 +359,12 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs,
  43
  44                 /* If tx burst fails move packets to end of bufs */
  45                 if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
  46 -                       slave_tx_fail_count[i] = slave_nb_bufs[i] -
  47 +                       int slave_tx_fail_count = slave_nb_bufs[i] -
  48                                         slave_tx_count;
  49 -                       total_tx_fail_count += slave_tx_fail_count[i];
  50 -
  51 -                       /*
  52 -                        * Shift bufs to beginning of array to allow reordering
  53 -                        * later
  54 -                        */
  55 -                       for (j = 0; j < slave_tx_fail_count[i]; j++) {
  56 -                               slave_bufs[i][j] =
  57 -                                       slave_bufs[i][(slave_tx_count - 1) + j];
  58 -                       }
  59 -               }
  60 -       }
  61 -
  62 -       /*
  63 -        * If there are tx burst failures we move packets to end of bufs to
  64 -        * preserve expected PMD behaviour of all failed transmitted being
  65 -        * at the end of the input mbuf array
  66 -        */
  67 -       if (unlikely(total_tx_fail_count > 0)) {
  68 -               int bufs_idx = nb_bufs - total_tx_fail_count - 1;
  69 -
  70 -               for (i = 0; i < slave_count; i++) {
  71 -                       if (slave_tx_fail_count[i] > 0) {
  72 -                               for (j = 0; j < slave_tx_fail_count[i]; j++)
  73 -                                       bufs[bufs_idx++] = slave_bufs[i][j];
  74 -                       }
  75 +                       total_tx_fail_count += slave_tx_fail_count;
  76 +                       memcpy(&bufs[nb_bufs - total_tx_fail_count],
  77 +                              &slave_bufs[i][slave_tx_count],
  78 +                              slave_tx_fail_count * sizeof(bufs[0]));
  79                 }
  80         }
  81
  82 @@ -716,8 +694,8 @@ bond_ethdev_tx_burst_round_robin(void *queue, struct rte_mbuf **bufs,
  83                                 tx_fail_total += tx_fail_slave;
  84
  85                                 memcpy(&bufs[nb_pkts - tx_fail_total],
  86 -                                               &slave_bufs[i][num_tx_slave],
  87 -                                               tx_fail_slave * sizeof(bufs[0]));
  88 +                                      &slave_bufs[i][num_tx_slave],
  89 +                                      tx_fail_slave * sizeof(bufs[0]));
  90                         }
  91                         num_tx_total += num_tx_slave;
  92                 }
  93 @@ -1222,10 +1200,10 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs,
  94         /* Mapping array generated by hash function to map mbufs to slaves */
  95         uint16_t bufs_slave_port_idxs[nb_bufs];
  96
  97 -       uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
  98 +       uint16_t slave_tx_count;
  99         uint16_t total_tx_count = 0, total_tx_fail_count = 0;
 100
 101 -       uint16_t i, j;
 102 +       uint16_t i;
 103
 104         if (unlikely(nb_bufs == 0))
 105                 return 0;
 106 @@ -1266,34 +1244,12 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs,
 107
 108                 /* If tx burst fails move packets to end of bufs */
 109                 if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
 110 -                       slave_tx_fail_count[i] = slave_nb_bufs[i] -
 111 +                       int slave_tx_fail_count = slave_nb_bufs[i] -
 112                                         slave_tx_count;
 113 -                       total_tx_fail_count += slave_tx_fail_count[i];
 114 -
 115 -                       /*
 116 -                        * Shift bufs to beginning of array to allow reordering
 117 -                        * later
 118 -                        */
 119 -                       for (j = 0; j < slave_tx_fail_count[i]; j++) {
 120 -                               slave_bufs[i][j] =
 121 -                                       slave_bufs[i][(slave_tx_count - 1) + j];
 122 -                       }
 123 -               }
 124 -       }
 125 -
 126 -       /*
 127 -        * If there are tx burst failures we move packets to end of bufs to
 128 -        * preserve expected PMD behaviour of all failed transmitted being
 129 -        * at the end of the input mbuf array
 130 -        */
 131 -       if (unlikely(total_tx_fail_count > 0)) {
 132 -               int bufs_idx = nb_bufs - total_tx_fail_count - 1;
 133 -
 134 -               for (i = 0; i < slave_count; i++) {
 135 -                       if (slave_tx_fail_count[i] > 0) {
 136 -                               for (j = 0; j < slave_tx_fail_count[i]; j++)
 137 -                                       bufs[bufs_idx++] = slave_bufs[i][j];
 138 -                       }
 139 +                       total_tx_fail_count += slave_tx_fail_count;
 140 +                       memcpy(&bufs[nb_bufs - total_tx_fail_count],
 141 +                              &slave_bufs[i][slave_tx_count],
 142 +                              slave_tx_fail_count * sizeof(bufs[0]));
 143                 }
 144         }
 145
 146 @@ -1320,10 +1276,10 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs,
 147         /* Mapping array generated by hash function to map mbufs to slaves */
 148         uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
 149
 150 -       uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
 151 +       uint16_t slave_tx_count;
 152         uint16_t total_tx_count = 0, total_tx_fail_count = 0;
 153
 154 -       uint16_t i, j;
 155 +       uint16_t i;
 156
 157         if (unlikely(nb_bufs == 0))
 158                 return 0;
 159 @@ -1381,39 +1337,13 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs,
 160
 161                         /* If tx burst fails move packets to end of bufs */
 162                         if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
 163 -                               slave_tx_fail_count[i] = slave_nb_bufs[i] -
 164 +                               int slave_tx_fail_count = slave_nb_bufs[i] -
 165                                                 slave_tx_count;
 166 -                               total_tx_fail_count += slave_tx_fail_count[i];
 167 -
 168 -                               /*
 169 -                                * Shift bufs to beginning of array to allow
 170 -                                * reordering later
 171 -                                */
 172 -                               for (j = 0; j < slave_tx_fail_count[i]; j++)
 173 -                                       slave_bufs[i][j] =
 174 -                                               slave_bufs[i]
 175 -                                                       [(slave_tx_count - 1)
 176 -                                                       + j];
 177 -                       }
 178 -               }
 179 +                               total_tx_fail_count += slave_tx_fail_count;
 180
 181 -               /*
 182 -                * If there are tx burst failures we move packets to end of
 183 -                * bufs to preserve expected PMD behaviour of all failed
 184 -                * transmitted being at the end of the input mbuf array
 185 -                */
 186 -               if (unlikely(total_tx_fail_count > 0)) {
 187 -                       int bufs_idx = nb_bufs - total_tx_fail_count - 1;
 188 -
 189 -                       for (i = 0; i < slave_count; i++) {
 190 -                               if (slave_tx_fail_count[i] > 0) {
 191 -                                       for (j = 0;
 192 -                                               j < slave_tx_fail_count[i];
 193 -                                               j++) {
 194 -                                               bufs[bufs_idx++] =
 195 -                                                       slave_bufs[i][j];
 196 -                                       }
 197 -                               }
 198 +                               memcpy(&bufs[nb_bufs - total_tx_fail_count],
 199 +                                      &slave_bufs[i][slave_tx_count],
 200 +                                      slave_tx_fail_count * sizeof(bufs[0]));
 201                         }
 202                 }
 203         }