[dpdk-dev] MLX5: Array written to out-of-bounds when freeing memory

[Daniel Pharos]

Hi,

Recently I had the privilege of some play-time on a IBM Power 9 machine with a Mellanox MLX5-card in it. However, I encountered a seg fault problem using DPDK and DPDK-pktgen. It's the exact same one as somebody else encountered (also on a Power 9) here:
https://bugzilla.redhat.com/show_bug.cgi?id=1634159#c10
It looks like it's writing out-of-bounds on the "free"-array in DPDK.

Reverting the patch that added the bulk-free ( http://mails.dpdk.org/archives/dev/2017-June/069154.html ) indeed makes DPDK and pktgen function correctly. A better workaround I found is to change drivers/net/mlx5/mlx5_rxtx.h, line 580 to:
                        if (likely((m->pool == pool) && (blk_n != elts_n))) {

I'm not familiar enough with the code to understand why the array is being written to out-of-bounds, and why it's only happening on a Power 9 machine. Unfortunately, my play-time is now over, but I thought I'd report this issue anyway, so hopefully it can be investigated and fixed properly.


Kind regards,
DanielPharos