app/testpmd: fix packet burst spreading stats
PATCH 1/1 app/testpmd: fix packet burst spreading stats
RX/TX functions (rte_eth_rx_burst/rte_eth_tx_burst) get 'nb_pkts' argument, which specifies the maximum number to receive/transmit. It can be 0..nb_pkts, meaning nb_pkts+1 options.
Enlarge the spread stats array by one cell to fix the possible out of range memory access.
--- app/test-pmd/testpmd.c | 2 +- app/test-pmd/testpmd.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
app/test-pmd/testpmd.c +1 -1
@@ -1873,7 +1873,7 @@ pkt_burst_stats_display(const char *rx_tx, struct pkt_burst_stats *pbs) pktnb_stats[0 ] =0 ;/* Find the next 2 burst sizes with highest occurrences. */ -for (nb_pkt =1 ; nb_pkt <MAX_PKT_BURST ; nb_pkt++) { +for (nb_pkt =1 ; nb_pkt <MAX_PKT_BURST +1 ; nb_pkt++) { nb_burst = pbs->pkt_burst_spread[nb_pkt];if (nb_burst ==0 )
app/test-pmd/testpmd.h +1 -1
@@ -96,7 +96,7 @@ enum {* that are recorded for each forwarding stream. */ struct pkt_burst_stats { -unsigned int pkt_burst_spread[MAX_PKT_BURST ]; +unsigned int pkt_burst_spread[MAX_PKT_BURST +1 ]; };/** Information for a given RSS type. */
Signature · 1 line
2.28.0.2311.g225365fb51
Quoted 6 lines · Eli Britstein
RX/TX functions (rte_eth_rx_burst/rte_eth_tx_burst) get '
nb_pkts' argument, which specifies the maximum number to receive/transmit. It can be 0..nb_pkts, meaning nb_pkts+1 options.
Enlarge the spread stats array by one cell to fix the possible out of range memory access.
This looks a valid problem, I guess problem is able to hide this long because of big MAX_PKT_BURST value in testpmd.
Can you please briefly describe what 'pkt_burst_spread[]' is in the commit log? That makes easy to understand the problem.
Quoted 5 lines
Fixes af75078fece3 ("first public release")Signed-off-by Eli Britstein <[email protected]>Reviewed-by Matan Azrad <[email protected]>
PATCH v2 1/1 app/testpmd: fix packet burst spreading stats
In reply to Eli BritsteinRX/TX functions (rte_eth_rx_burst/rte_eth_tx_burst) get 'nb_pkts' argument, which specifies the maximum number to receive/transmit. It can be 0..nb_pkts, meaning nb_pkts+1 options.
Testpmd can provide statistics of the burst sizes ('set record-burst-stats on') by incrementing an array cell of index <burst-size>. This array is mistakenly [MAX_PKT_BURST] size. Receiving the maximum burst will cause out of bound write.
Enlarge the spread stats array by one cell to fix it.
--- app/test-pmd/testpmd.c | 2 +- app/test-pmd/testpmd.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
app/test-pmd/testpmd.c +1 -1
@@ -1873,7 +1873,7 @@ pkt_burst_stats_display(const char *rx_tx, struct pkt_burst_stats *pbs) pktnb_stats[0 ] =0 ;/* Find the next 2 burst sizes with highest occurrences. */ -for (nb_pkt =1 ; nb_pkt <MAX_PKT_BURST ; nb_pkt++) { +for (nb_pkt =1 ; nb_pkt <MAX_PKT_BURST +1 ; nb_pkt++) { nb_burst = pbs->pkt_burst_spread[nb_pkt];if (nb_burst ==0 )
app/test-pmd/testpmd.h +1 -1
@@ -96,7 +96,7 @@ enum {* that are recorded for each forwarding stream. */ struct pkt_burst_stats { -unsigned int pkt_burst_spread[MAX_PKT_BURST ]; +unsigned int pkt_burst_spread[MAX_PKT_BURST +1 ]; };/** Information for a given RSS type. */
Signature · 1 line
2.28.0.2311.g225365fb51
Ferruh Yigit
AppliedQuoted 9 lines · Eli Britstein
RX/TX functions (rte_eth_rx_burst/rte_eth_tx_burst) get '
nb_pkts' argument, which specifies the maximum number to receive/transmit. It can be 0..nb_pkts, meaning nb_pkts+1 options.
Testpmd can provide statistics of the burst sizes ('set record-burst-stats on') by incrementing an array cell of index <burst-size>. This array is mistakenly [MAX_PKT_BURST] size. Receiving the maximum burst will cause out of bound write.
Enlarge the spread stats array by one cell to fix it.
Quoted 6 lines
Fixes af75078fece3 ("first public release")Signed-off-by Eli Britstein <[email protected]>Reviewed-by Matan Azrad <[email protected]>Acked-by Ferruh Yigit <[email protected]>
Applied to dpdk-next-net/main, thanks.