[dpdk-dev] [dpdk-stable] [v2] test/mempool: fix heap buffer overflow

[Olivier Matz]

On Tue, Apr 13, 2021 at 01:52:26PM +0200, Thomas Monjalon wrote:
> 13/04/2021 22:05, Wenwu Ma:
> > Amount of allocated memory was not enough for mempool
> > which cause buffer overflow when access fields of mempool
> > private structure in the rte_pktmbuf_priv_size function.
>
> Was it causing the test to fail?
> How do you reproduce the overflow?

In the test, right after the rte_mempool_create(), the function
rte_mempool_obj_iter() is called too initialize the mempool objects with
the rte_pktmbuf_init() callback function. This callback expects that the
mempool is a packet pool, i.e. its private area is a struct
rte_pktmbuf_pool_private structure.

In the current test, the size of the private area is 0, which probably
causes the function rte_pktmbuf_priv_size() to return an unpredictable
value, and this value is used as a size in a memset.

This part of the test was added in commit 923ceaeac140 ("test/mempool:
add unit test cases").

Instead of changing the size of the private area like done in the patch,
I suggest to use another callback than rte_pktmbuf_init(). After all,
this is a mempool test, so we should not rely on mbuf features. The
function my_obj_init() could be used like in other places of the test,
like this:

  @@ -552,7 +552,7 @@ test_mempool(void)
  		 GOTO_ERR(ret, err);
  
  	 /* test to initialize mempool objects and memory */
  -        nb_objs = rte_mempool_obj_iter(mp_stack_mempool_iter, rte_pktmbuf_init,
  +        nb_objs = rte_mempool_obj_iter(mp_stack_mempool_iter, my_obj_init,
  			 NULL);
  	 if (nb_objs == 0)
  		 GOTO_ERR(ret, err);


Wenwu, does it solve your issue?


Regards,
Olivier