From patchwork Mon Sep 4 07:10:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joyce Kong X-Patchwork-Id: 131138 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 815E6424EC; Mon, 4 Sep 2023 09:11:04 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 75710402C7; Mon, 4 Sep 2023 09:11:04 +0200 (CEST) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mails.dpdk.org (Postfix) with ESMTP id A173A402C7; Mon, 4 Sep 2023 09:11:03 +0200 (CEST) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id E8FA311FB; Mon, 4 Sep 2023 00:11:40 -0700 (PDT) Received: from net-arm-n1amp-02.shanghai.arm.com (net-arm-n1amp-02.shanghai.arm.com [10.169.210.107]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 2431D3F8A4; Mon, 4 Sep 2023 00:10:59 -0700 (PDT) From: Joyce Kong To: Jakub Grajciar , =?utf-8?q?Morten_Br=C3=B8rup?= , Ruifeng Wang , Joyce Kong Cc: dev@dpdk.org, nd@arm.com, stable@dpdk.org, Feifei Wang Subject: [PATCH v1] net/memif: fix segfault with large burst size Date: Mon, 4 Sep 2023 07:10:41 +0000 Message-Id: <20230904071041.3403495-1-joyce.kong@arm.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org There will be a segfault when Rx burst size is greater than MAX_PKT_BURST of memif. Fix the issue by correcting the wrong mbuf index in eth_memif_rx, which results in accessing invalid memory address. Bugzilla ID: 1273 Fixes: aa17df860891 ("net/memif: add a Rx fast path") Cc: stable@dpdk.org Signed-off-by: Joyce Kong Reviewed-by: Feifei Wang Reviewed-by: Ruifeng Wang Reviewed-by: Ferruh Yigit --- drivers/net/memif/rte_eth_memif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/memif/rte_eth_memif.c b/drivers/net/memif/rte_eth_memif.c index 6a8ff5b4eb..f595656af5 100644 --- a/drivers/net/memif/rte_eth_memif.c +++ b/drivers/net/memif/rte_eth_memif.c @@ -356,7 +356,7 @@ eth_memif_rx(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) rx_pkts = 0; pkts = nb_pkts < MAX_PKT_BURST ? nb_pkts : MAX_PKT_BURST; while (n_slots && rx_pkts < pkts) { - mbuf_head = mbufs[n_rx_pkts]; + mbuf_head = mbufs[rx_pkts]; mbuf = mbuf_head; next_slot1: