diff mbox series

net/memif: fix buffer overflow in zero copy Rx

Message ID 102781f4-e82c-4780-acb5-fad92fb2c30b@broadcom.com (mailing list archive)
State Superseded, archived
Delegated to: Ferruh Yigit
Headers
Series net/memif: fix buffer overflow in zero copy Rx |

Checks

Context Check Description
ci/loongarch-compilation warning apply patch failure
ci/checkpatch warning coding style issues
ci/Intel-compilation warning apply issues
ci/iol-testing warning apply patch failure

Commit Message

Mihai Brodschi June 28, 2024, 7:45 p.m. UTC 
rte_pktmbuf_alloc_bulk is called by the zero-copy receiver to allocate
new mbufs to be provided to the sender. The allocated mbuf pointers
are stored in a ring, but the alloc function doesn't implement index
wrap-around, so it writes past the end of the array. This results in
memory corruption and duplicate mbufs being received.

Allocate 2x the space for the mbuf ring, so that the alloc function
has a contiguous array to write to, then copy the excess entries
to the start of the array.

Fixes: 43b815d88188 ("net/memif: support zero-copy slave")
Cc: stable@dpdk.org
Signed-off-by: Mihai Brodschi <mihai.brodschi@broadcom.com>
---
  drivers/net/memif/rte_eth_memif.c | 10 +++++++++-
  1 file changed, 9 insertions(+), 1 deletion(-)

  	while (n_slots--) {
  		s0 = head++ & mask;
@@ -1245,8 +1249,12 @@ memif_init_queues(struct rte_eth_dev *dev)
  		}
  		mq->buffers = NULL;
  		if (pmd->flags & ETH_MEMIF_FLAG_ZERO_COPY) {
+			/*
+			 * Allocate 2x ring_size to reserve a contiguous array for
+			 * rte_pktmbuf_alloc_bulk (to store allocated mbufs).
+			 */
  			mq->buffers = rte_zmalloc("bufs", sizeof(struct rte_mbuf *) *
-						  (1 << mq->log2_ring_size), 0);
+						  (1 << (mq->log2_ring_size + 1)), 0);
  			if (mq->buffers == NULL)
  				return -ENOMEM;
  		}
diff mbox series

Patch

diff --git a/drivers/net/memif/rte_eth_memif.c 
b/drivers/net/memif/rte_eth_memif.c
index 16da22b5c6..3491c53cf1 100644
--- a/drivers/net/memif/rte_eth_memif.c
+++ b/drivers/net/memif/rte_eth_memif.c
@@ -600,6 +600,10 @@  eth_memif_rx_zc(void *queue, struct rte_mbuf 
**bufs, uint16_t nb_pkts)
  	ret = rte_pktmbuf_alloc_bulk(mq->mempool, &mq->buffers[head & mask], 
n_slots);
  	if (unlikely(ret < 0))
  		goto no_free_mbufs;
+	if (unlikely(n_slots > ring_size - (head & mask))) {
+		rte_memcpy(mq->buffers, &mq->buffers[ring_size],
+			(n_slots + (head & mask) - ring_size) * sizeof(struct rte_mbuf *));
+	}