[dpdk-dev] [PATCH 2/2] net/bonding: fix oob access in "other" aggregator modes

[David Marchand]

On Sun, Mar 24, 2019 at 2:35 PM Chas Williams <3chas3 at gmail.com> wrote:

> Have you ever experienced this problem in practice? I ask because I am
> considering some fixes that would limit the number of slaves to a more
> reasonable number (and reduce the over stack usage of the bonding driver
> in general).
>

Not too hard to reproduce, the problem is not the number of slaves.
With a default RTE_MAX_ETHPORTS at 32, any slave whose portid >= 8 would
trigger an oob access.


Example:
# git describe
v19.02-294-gad2f555

# gdb ./master/app/testpmd
(gdb) b selection_logic
(gdb) run -c 0x3 --no-pci --vdev net_ring0 --vdev net_ring1 --vdev
net_ring2 --vdev net_ring3 --vdev net_ring4 --vdev net_ring5 --vdev
net_ring6 --vdev net_ring7 --vdev net_ring8 --vdev net_ring9 --vdev
net_bonding0,mode=4,slave=8,slave=9 -- -i --total-num-mbufs 2048

Breakpoint 1, selection_logic (internals=0x17fe51980, slave_id=8) at
/root/dpdk/drivers/net/bonding/rte_eth_bond_8023ad.c:670
670        uint16_t slaves_count, new_agg_id, i, j = 0;
Missing separate debuginfos, use: debuginfo-install
glibc-2.17-260.el7_6.3.x86_64 libgcc-4.8.5-36.el7.x86_64
numactl-libs-2.0.9-7.el7.x86_64
(gdb) n
672        uint64_t agg_bandwidth[8] = {0};
(gdb)
673        uint64_t agg_count[8] = {0};
(gdb)
674        uint16_t default_slave = 0;
(gdb) p agg_bandwidth
$1 = {0, 0, 0, 0, 0, 0, 0, 0}
(gdb) p agg_count
$2 = {0, 0, 0, 0, 0, 0, 0, 0}
(gdb) n
678        slaves = internals->active_slaves;
(gdb)
679        slaves_count = internals->active_slave_count;
(gdb)
680        port = &bond_mode_8023ad_ports[slave_id];
(gdb)
683        for (i = 0; i < slaves_count; ++i) {
(gdb)
684            agg = &bond_mode_8023ad_ports[slaves[i]];
(gdb)
686            if (agg->aggregator_port_id != slaves[i])
(gdb)
689            agg_count[agg->aggregator_port_id] += 1;
(gdb)
690            rte_eth_link_get_nowait(slaves[i], &link_info);
(gdb) p agg_bandwidth
$3 = {1, 0, 0, 0, 0, 0, 0, 0}
(gdb) p agg_count
$4 = {0, 0, 0, 0, 0, 0, 0, 0}


-- 
David Marchand