From patchwork Thu Jan 16 19:56:38 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ariel Otilibili X-Patchwork-Id: 150153 X-Patchwork-Delegate: stephen@networkplumber.org Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (unknown [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id BD11E46054; Thu, 16 Jan 2025 20:57:24 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id D535240E35; Thu, 16 Jan 2025 20:56:55 +0100 (CET) Received: from mail-ej1-f98.google.com (mail-ej1-f98.google.com [209.85.218.98]) by mails.dpdk.org (Postfix) with ESMTP id A96F540E2A for ; Thu, 16 Jan 2025 20:56:53 +0100 (CET) Received: by mail-ej1-f98.google.com with SMTP id a640c23a62f3a-aafc9d75f8bso232638066b.2 for ; Thu, 16 Jan 2025 11:56:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1737057413; x=1737662213; darn=dpdk.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LODOdMgykO+JdnQSIOiFbN0zFxrhoevkVTT9PrriXaw=; b=i/ynusjBO4XOb0l5UAF5t5HvTZAJNmkZP9yss/vwyhAP1cRtQvBbz2Qxefa5hJSvGf s6+Y6k9B3ySplGgILgvqUmqlpHehYM0JGBhcJrKp2p6dl5j/tRxqY8m8SLld1UD1i+kV ii6tmZY5LLIRERMBGo3mDHTba0frzqY1pB04myuNe8youaRiojUw3f6yoPUCmY+oUKkU eBAc59XYaRw0FqnbgqS1aXz1Z8rrDZBiITlAUIiMGXphfJJcnAcGtQmqjVH97y7lp53U l4jDf+a7giIn+OBMKVHf6XTrgBXQuAzclk+cy2A+twMiUqWg/fI7tGRQk26ymwthHgX5 GhFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737057413; x=1737662213; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LODOdMgykO+JdnQSIOiFbN0zFxrhoevkVTT9PrriXaw=; b=iLgUKpFuJ+3l93nudn3LLOhzx3etlSoozVHR3/026L9Uh1Bikf9/HNE8FEh/NMhDRt C6/b7jEkLFXkjywnJvCaeZCv7O4Hws//8XHktRy6QqQpVlM6pin0s+cmyzo7vn9+e/64 c40Gctw+Urs2nN7FOGs9xivMSekdqJbYvdwtNIuBz6DyyAj9dQqlioxgRYL8C4QTocr7 9/KAZ/HHcDFmSgQCv3u/KR4ZpWXLds0gW/Oi0LphyfiRqg2TSxNeHJg94vWpEAI3jM9M mrYiQnfHmHU8JgjUf/9ZPpGhWmdxMTKpE0pkyV/PFz5mG5BXlSCg+qUqxEIqsEGx3LJM T+ag== X-Gm-Message-State: AOJu0YxPxDcLu2Y3fKMJS5ncOYaatGsUpZBlZ6S0aCNZm4XwZHUZgLz5 t6jzy5FHTQT7gBT7TQSymi4Bu/QIikjy0OpCjgCNoAZjjjKDmUq/H7ZG4T0wX5leVNaWOz1CGIk FDEP0/spUYVWF/GcUwqTrf9xAfG3N6VWpSj1a53iG X-Gm-Gg: ASbGncugndtJR+jB0dKhXT+wkHBttUlTdhjU8dAxLnspgOTZT5v5jLVUvaIRY2jEIOz j/4AKkJKXZlCfWRmPr8XQwG5auDIRFQ+7L0jmXho7B31EVh3zFtPP4hyTsLKMbhQSpfyK6nJTb9 mnHzW0N1dCUGW9i/FZQ6NQXn85ELEOaYC1Uho62KgnbTjMXr9datwYUzpKOSLa1bJLYfai8SaMk z2OtHSRky72i2JlB2E5zzN0lEox2Xnu4eID6Vn+kx6e5EjjzJQ1GRk4zjWMTbz+auph5gtdewwI 4a+qcJ/Ku8rihMjVV+5tOG6b7A== X-Google-Smtp-Source: AGHT+IHWWPoKkH9GeqFX3MGKSTCqEXYOnfXWp098O70VcK03IBEFH5ueZGOTYCKStDH2SpbD+VyJ1sYLk8Te X-Received: by 2002:a17:907:7205:b0:ab3:88a0:b71d with SMTP id a640c23a62f3a-ab38b2e734fmr9859366b.34.1737057413277; Thu, 16 Jan 2025 11:56:53 -0800 (PST) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id a640c23a62f3a-ab3852d4e78sm1153866b.243.2025.01.16.11.56.53; Thu, 16 Jan 2025 11:56:53 -0800 (PST) X-Relaying-Domain: 6wind.com Received: from localhost (rainbow.dev.6wind.com [10.17.1.165]) by smtpservice.6wind.com (Postfix) with ESMTP id 25F5111C78; Thu, 16 Jan 2025 20:56:53 +0100 (CET) From: Ariel Otilibili To: dev@dpdk.org Cc: stable@dpdk.org, Stephen Hemminger , Thomas Monjalon , David Marchand , Ariel Otilibili , Ciara Loftus , Maryam Tahhan Subject: [PATCH 1/2] net/af_xdp: fix use after free in af_xdp_tx_zc() Date: Thu, 16 Jan 2025 20:56:38 +0100 Message-Id: <20250116195640.68885-2-ariel.otilibili@6wind.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20250116195640.68885-1-ariel.otilibili@6wind.com> References: <20250116195640.68885-1-ariel.otilibili@6wind.com> MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org tx_bytes is computed after both branches are tested. This might produce a use after memory free. The computation is now moved into both branches. Bugzilla ID: 1440 Fixes: d8a210774e1d ("net/af_xdp: support unaligned umem chunks") Signed-off-by: Ariel Otilibili Acked-by: Stephen Hemminger --- drivers/net/af_xdp/rte_eth_af_xdp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/af_xdp/rte_eth_af_xdp.c b/drivers/net/af_xdp/rte_eth_af_xdp.c index 814398ba4b44..4326a29f7042 100644 --- a/drivers/net/af_xdp/rte_eth_af_xdp.c +++ b/drivers/net/af_xdp/rte_eth_af_xdp.c @@ -574,6 +574,7 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) umem->mb_pool->header_size; offset = offset << XSK_UNALIGNED_BUF_OFFSET_SHIFT; desc->addr = addr | offset; + tx_bytes += mbuf->pkt_len; count++; } else { struct rte_mbuf *local_mbuf = @@ -601,11 +602,10 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) desc->addr = addr | offset; rte_memcpy(pkt, rte_pktmbuf_mtod(mbuf, void *), desc->len); + tx_bytes += mbuf->pkt_len; rte_pktmbuf_free(mbuf); count++; } - - tx_bytes += mbuf->pkt_len; } out: From patchwork Thu Jan 16 19:56:39 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ariel Otilibili X-Patchwork-Id: 150154 X-Patchwork-Delegate: stephen@networkplumber.org Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (unknown [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id CC19D46054; Thu, 16 Jan 2025 20:57:38 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 5181040E43; Thu, 16 Jan 2025 20:56:57 +0100 (CET) Received: from mail-ed1-f100.google.com (mail-ed1-f100.google.com [209.85.208.100]) by mails.dpdk.org (Postfix) with ESMTP id 1937D40E2F for ; Thu, 16 Jan 2025 20:56:55 +0100 (CET) Received: by mail-ed1-f100.google.com with SMTP id 4fb4d7f45d1cf-5d3f28881d6so1906033a12.1 for ; Thu, 16 Jan 2025 11:56:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; t=1737057415; x=1737662215; darn=dpdk.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=SbESKSN2q4E3qqpOKxkuXmOnDL7NG2FMggwALyRyQ/M=; b=htEml8GK0m80VKIblmF6h2Lm2/X0MLMc1jcr8CZbt24UuGY0WBMOhi6kCdeBCQRo8S /GFtD2+eHYrC7ebx5HRBZqW8xEqEydnx7PbWejVcgcv+8MmWu9Yl7ZtVJ6fF+S/GZgTV bVnhsadSjPOj3x0IT4IAqcMAAYhY00tM01/pOAoezBDO9TYSuBPu+cbPlj36W9hIslz2 +ZtPRcFeTwM3wQQc2kMvSQBa9S7/eT3oHQcPax5ekfLx9lvNgLbLFJAETvPBoCq2bqGr 2yyNvNVE2KLBF6UF4Xsu7ORouoHgGBNIpgG3Y/fy5U9wYTpoI0kLlrsE647NYIDeZHza KMTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737057415; x=1737662215; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=SbESKSN2q4E3qqpOKxkuXmOnDL7NG2FMggwALyRyQ/M=; b=cIIdK9IVyjpUtjlPD82aEBBaWwwh82fDYYN2sWxg1v5F1shvdwoHekp+UR8nBN/piT Mfphb117ToxuVeXE+3hyQslKkMWW4G5GFAGHJ1wjC2D+aCHvoZikmCdpXVDRcZTZxqZd FHKUhSqUcR8AIQaWipLk3JOgJ+8Ifjeipb0b322Zh0U8rRy2c5Cb3ZBwSO4vNhgw4Ikm ak9kAlz9bUnnvO8x7JLnsUd2Y/HYUL8oR9fSm7b0ewQ5Y6gYJCYCRmddo0CH13dRUpbL A0pu5kDwc7xAi12F++nXPGS7AvtAZbQR9Svh5RjtiCW7Q3b2QTXk7uB+GDJdecLaFgs6 3EEQ== X-Gm-Message-State: AOJu0Ywvj88YfyktwIBJO7WDsTHQrB9EsK5GheWQF4LpaoGArgi+KrBK TGskQA+1bs1XiYpo853EvXsfRZQX7xCmJnH7gYeFSavkpj9BcT0qqQWQIxLlSzFUG2sPQOAmwKX g9PX5ZBghZZBzWEUw1V2d4a0UPei7mSmVIBi0UTqz X-Gm-Gg: ASbGnctkA3/yyxMfDl6tAaS4WWO0O43nT+tSEbsCyLuXYfOjZIFHJ3gaAf15hAM2Nmc TifPPxgZiYatSF6OLH6EqzlR3mUz5Vc+BFrmk6OwVgRz82jNARkPZz86TO6y1McOH7gryBvbugK OFoTzHCXdcsSCt5DxBtqgWGdgBq4aDSgm9D5ckW2e+yYMVtrVezXlr6Um1auEBZUi+6AjFLLy9y pnPhxLP5p0OfkaZblOPelEIonBltdu/liiuj28LzGLk+SDMfHUyCgVT2lCzHVFRyOrBNa3IQdsF IGfWwTrhlWiHI6uHCvGxCPAWBg== X-Google-Smtp-Source: AGHT+IFvhkAOB/dJRVKvH/qDnkTobvFj3zv9dDxYg35/odDrkwjLbjfzxMcyNmxhCUQXH+kqYsb7ZeMfUg1V X-Received: by 2002:a05:6402:35ca:b0:5d0:d818:559d with SMTP id 4fb4d7f45d1cf-5d972e0b955mr5452159a12.11.1737057414534; Thu, 16 Jan 2025 11:56:54 -0800 (PST) Received: from smtpservice.6wind.com ([185.13.181.2]) by smtp-relay.gmail.com with ESMTP id a640c23a62f3a-ab384d8531csm1159066b.3.2025.01.16.11.56.54; Thu, 16 Jan 2025 11:56:54 -0800 (PST) X-Relaying-Domain: 6wind.com Received: from localhost (rainbow.dev.6wind.com [10.17.1.165]) by smtpservice.6wind.com (Postfix) with ESMTP id 5E6B411C79; Thu, 16 Jan 2025 20:56:54 +0100 (CET) From: Ariel Otilibili To: dev@dpdk.org Cc: stable@dpdk.org, Stephen Hemminger , Thomas Monjalon , David Marchand , Ariel Otilibili , Ciara Loftus , Maryam Tahhan Subject: [PATCH 2/2] net/af_xdp: Refactor af_xdp_tx_zc() Date: Thu, 16 Jan 2025 20:56:39 +0100 Message-Id: <20250116195640.68885-3-ariel.otilibili@6wind.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20250116195640.68885-1-ariel.otilibili@6wind.com> References: <20250116195640.68885-1-ariel.otilibili@6wind.com> MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Both branches of the loop share the same logic. Now each one is a goto dispatcher; either to out (end of function), or to stats (continuation of the loop). Bugzilla ID: 1440 Depends-on: patch-1 ("net/af_xdp: fix use after free in af_xdp_tx_zc()") Signed-off-by: Ariel Otilibili --- drivers/net/af_xdp/rte_eth_af_xdp.c | 57 ++++++++++++++--------------- 1 file changed, 27 insertions(+), 30 deletions(-) diff --git a/drivers/net/af_xdp/rte_eth_af_xdp.c b/drivers/net/af_xdp/rte_eth_af_xdp.c index 4326a29f7042..8b42704b6d9f 100644 --- a/drivers/net/af_xdp/rte_eth_af_xdp.c +++ b/drivers/net/af_xdp/rte_eth_af_xdp.c @@ -551,6 +551,7 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) uint64_t addr, offset; struct xsk_ring_cons *cq = &txq->pair->cq; uint32_t free_thresh = cq->size >> 1; + struct rte_mbuf *local_mbuf = NULL; if (xsk_cons_nb_avail(cq, free_thresh) >= free_thresh) pull_umem_cq(umem, XSK_RING_CONS__DEFAULT_NUM_DESCS, cq); @@ -565,21 +566,10 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) &idx_tx)) goto out; } - desc = xsk_ring_prod__tx_desc(&txq->tx, idx_tx); - desc->len = mbuf->pkt_len; - addr = (uint64_t)mbuf - (uint64_t)umem->buffer - - umem->mb_pool->header_size; - offset = rte_pktmbuf_mtod(mbuf, uint64_t) - - (uint64_t)mbuf + - umem->mb_pool->header_size; - offset = offset << XSK_UNALIGNED_BUF_OFFSET_SHIFT; - desc->addr = addr | offset; - tx_bytes += mbuf->pkt_len; - count++; + + goto stats; } else { - struct rte_mbuf *local_mbuf = - rte_pktmbuf_alloc(umem->mb_pool); - void *pkt; + local_mbuf = rte_pktmbuf_alloc(umem->mb_pool); if (local_mbuf == NULL) goto out; @@ -589,23 +579,30 @@ af_xdp_tx_zc(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) goto out; } - desc = xsk_ring_prod__tx_desc(&txq->tx, idx_tx); - desc->len = mbuf->pkt_len; - - addr = (uint64_t)local_mbuf - (uint64_t)umem->buffer - - umem->mb_pool->header_size; - offset = rte_pktmbuf_mtod(local_mbuf, uint64_t) - - (uint64_t)local_mbuf + - umem->mb_pool->header_size; - pkt = xsk_umem__get_data(umem->buffer, addr + offset); - offset = offset << XSK_UNALIGNED_BUF_OFFSET_SHIFT; - desc->addr = addr | offset; - rte_memcpy(pkt, rte_pktmbuf_mtod(mbuf, void *), - desc->len); - tx_bytes += mbuf->pkt_len; - rte_pktmbuf_free(mbuf); - count++; + goto stats; } +stats: + struct rte_mbuf *tmp; + void *pkt; + tmp = mbuf->pool == umem->mb_pool ? mbuf : local_mbuf; + + desc = xsk_ring_prod__tx_desc(&txq->tx, idx_tx); + desc->len = mbuf->pkt_len; + + addr = (uint64_t)tmp - (uint64_t)umem->buffer - umem->mb_pool->header_size; + offset = rte_pktmbuf_mtod(tmp, uint64_t) - (uint64_t)tmp + umem->mb_pool->header_size; + offset = offset << XSK_UNALIGNED_BUF_OFFSET_SHIFT; + desc->addr = addr | offset; + + if (mbuf->pool == umem->mb_pool) { + tx_bytes += mbuf->pkt_len; + } else { + pkt = xsk_umem__get_data(umem->buffer, addr + offset); + rte_memcpy(pkt, rte_pktmbuf_mtod(mbuf, void *), desc->len); + tx_bytes += mbuf->pkt_len; + rte_pktmbuf_free(mbuf); + } + count++; } out: