Skip to contentSkip to conversation

app/dma-perf: fix dma mapping access overruns

PATCH New Mingjin Ye 2 participants 3 messages Jul 20, 2023 – Nov 14, 2023

lore
Share & tools
lore

Mingjin Ye

author
#0 lore raw

PATCH 1/1 app/dma-perf: fix dma mapping access overruns

The dma map supports a maximum of MAX_WORKER_NB=128. Initializing the dma map allows a maximum support of MAX_WORKER_NB=256. This results in memory access out-of-bounds when the actual dma entries exceed MAX_WORKER_NB.

This patch talks about MAX_WORKER_NB and MAX_WORKER_NB size set to 256 to fix this.

Signed-off-by Mingjin Ye <[email protected]>
---
 app/test-dma-perf/main.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)
app/test-dma-perf/main.h +3 -2
index f65e264378..602ecac858 100644
@@ -10,11 +10,12 @@
 #include <rte_cycles.h>
 #include <rte_dev.h>
 
-#define MAX_WORKER_NB 128
+#define MAX_WORKER_NB 256
 #define MAX_OUTPUT_STR_LEN 512
 
 #define MAX_DMA_NB 128
-#define MAX_LCORE_NB 256
+/* Note that MAX_LCORE_NB <= MAX_WORKER_NB */
+#define MAX_LCORE_NB MAX_WORKER_NB
 
 extern char output_str[MAX_WORKER_NB + 1][MAX_OUTPUT_STR_LEN];
Signature · 1 line
2.25.1
author
#1 lore raw

PATCH v2 1/1 app/dma-perf: fix lcores array out of bounds access

The default size of the lcores array in the lcore dma map is MAX_WORKER_NB. However, when parsing configuration parameters, MAX_LCORE_NB is used as a constraint. Since MAX_LCORE_NB is greater than MAX_WORKER_NB, this causes array access to go out of bounds when the value of the lcore_dma/lcore configuration item in the parameter file is greater than MAX_WORKER_NB.

This patch fixes the issue by removing the MAX_LCORE_NB macro and using MAX_WORKER_NB consistently.

Fixes 623dc9364dc6 ("app/dma-perf: introduce DMA performance test")
Signed-off-by Mingjin Ye <[email protected]>

---
v2:A better solution.

---
 app/test-dma-perf/main.c | 4 ++--
 app/test-dma-perf/main.h | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)
app/test-dma-perf/main.c +2 -2
index e5bccc27da..5f8bab8f45 100644
@@ -177,7 +177,7 @@ parse_lcore(struct test_configure *test_case, const char *value)
 
 	char *token = strtok(input, ", ");
 	while (token != NULL) {
-		if (lcore_dma_map->cnt >= MAX_LCORE_NB) {
+		if (lcore_dma_map->cnt >= MAX_WORKER_NB) {
 			free(input);
 			return -1;
 		}

@@ -248,7 +248,7 @@ parse_lcore_dma(struct test_configure *test_case, const char *value)
 		}
 
 		lcore_dma_map = &test_case->lcore_dma_map;
-		if (lcore_dma_map->cnt >= MAX_LCORE_NB) {
+		if (lcore_dma_map->cnt >= MAX_WORKER_NB) {
 			fprintf(stderr, "lcores count error\n");
 			ret = -1;
 			break;
app/test-dma-perf/main.h +0 -1
index f65e264378..62085e6e8f 100644
@@ -14,7 +14,6 @@
 #define MAX_OUTPUT_STR_LEN 512
 
 #define MAX_DMA_NB 128
-#define MAX_LCORE_NB 256
 
 extern char output_str[MAX_WORKER_NB + 1][MAX_OUTPUT_STR_LEN];
Signature · 1 line
2.25.1
Applied
#2 lore raw

Re: [PATCH v2] app/dma-perf: fix lcores array out of bounds access

26/10/2023 11:53, Mingjin Ye:

Quoted 8 lines

The default size of the lcores array in the lcore dma map is MAX_WORKER_NB. However, when parsing configuration parameters, MAX_LCORE_NB is used as a constraint. Since MAX_LCORE_NB is greater than MAX_WORKER_NB, this causes array access to go out of bounds when the value of the lcore_dma/lcore configuration item in the parameter file is greater than MAX_WORKER_NB.

Quoted 6 lines

This patch fixes the issue by removing the MAX_LCORE_NB macro and using MAX_WORKER_NB consistently.

Fixes 623dc9364dc6 ("app/dma-perf: introduce DMA performance test")
Signed-off-by Mingjin Ye <[email protected]>

Applied, thanks.