Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/105372/?format=api
{ "id": 105372, "url": "http://patches.dpdk.org/api/patches/105372/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/5cd9086411342c7475e3227249d3aa3a3144897d.1640314881.git.wangyunjian@huawei.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<5cd9086411342c7475e3227249d3aa3a3144897d.1640314881.git.wangyunjian@huawei.com>", "list_archive_url": "https://inbox.dpdk.org/dev/5cd9086411342c7475e3227249d3aa3a3144897d.1640314881.git.wangyunjian@huawei.com", "date": "2021-12-24T03:06:19", "name": "[1/1] net/mlx5: fix stack buffer overflow of hrxq's rss_key", "commit_ref": null, "pull_url": null, "state": "accepted", "archived": true, "hash": "922ec5a6765104bc86e34ca4fa0d6610eb08baa1", "submitter": { "id": 551, "url": "http://patches.dpdk.org/api/people/551/?format=api", "name": "Yunjian Wang", "email": "wangyunjian@huawei.com" }, "delegate": { "id": 3268, "url": "http://patches.dpdk.org/api/users/3268/?format=api", "username": "rasland", "first_name": "Raslan", "last_name": "Darawsheh", "email": "rasland@nvidia.com" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/5cd9086411342c7475e3227249d3aa3a3144897d.1640314881.git.wangyunjian@huawei.com/mbox/", "series": [ { "id": 21022, "url": "http://patches.dpdk.org/api/series/21022/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=21022", "date": "2021-12-24T03:06:19", "name": "[1/1] net/mlx5: fix stack buffer overflow of hrxq's rss_key", "version": 1, "mbox": "http://patches.dpdk.org/series/21022/mbox/" } ], "comments": "http://patches.dpdk.org/api/patches/105372/comments/", "check": "success", "checks": "http://patches.dpdk.org/api/patches/105372/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from mails.dpdk.org (mails.dpdk.org [217.70.189.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id F2A06A00C5;\n\tFri, 24 Dec 2021 04:07:07 +0100 (CET)", "from [217.70.189.124] (localhost [127.0.0.1])\n\tby mails.dpdk.org (Postfix) with ESMTP id 834EB40691;\n\tFri, 24 Dec 2021 04:07:07 +0100 (CET)", "from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255])\n by mails.dpdk.org (Postfix) with ESMTP id E3E1E4068C;\n Fri, 24 Dec 2021 04:07:05 +0100 (CET)", "from dggpemm500023.china.huawei.com (unknown [172.30.72.53])\n by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4JKsMr3jTSz1DKHY;\n Fri, 24 Dec 2021 11:03:52 +0800 (CST)", "from dggpemm500008.china.huawei.com (7.185.36.136) by\n dggpemm500023.china.huawei.com (7.185.36.83) with Microsoft SMTP Server\n (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id\n 15.1.2308.20; Fri, 24 Dec 2021 11:07:03 +0800", "from localhost (10.174.242.157) by dggpemm500008.china.huawei.com\n (7.185.36.136) with Microsoft SMTP Server (version=TLS1_2,\n cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.20; Fri, 24 Dec\n 2021 11:07:03 +0800" ], "From": "Yunjian Wang <wangyunjian@huawei.com>", "To": "<dev@dpdk.org>", "CC": "<matan@nvidia.com>, <viacheslavo@nvidia.com>, <michaelba@nvidia.com>,\n <dingxiaoxiong@huawei.com>, <xudingke@huawei.com>, Yunjian Wang\n <wangyunjian@huawei.com>, <stable@dpdk.org>", "Subject": "[dpdk-dev] [PATCH 1/1] net/mlx5: fix stack buffer overflow of hrxq's\n rss_key", "Date": "Fri, 24 Dec 2021 11:06:19 +0800", "Message-ID": "\n <5cd9086411342c7475e3227249d3aa3a3144897d.1640314881.git.wangyunjian@huawei.com>", "X-Mailer": "git-send-email 1.9.5.msysgit.1", "MIME-Version": "1.0", "Content-Type": "text/plain", "X-Originating-IP": "[10.174.242.157]", "X-ClientProxiedBy": "dggems701-chm.china.huawei.com (10.3.19.178) To\n dggpemm500008.china.huawei.com (7.185.36.136)", "X-CFilter-Loop": "Reflected", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org" }, "content": "The mlx5_drop_action_create function use mlx5_malloc for allocating\n'hrxq', but don't allocate for 'rss_key'. This is wrong and it can\ncause buffer overflow.\n\nDetected with address sanitizer:\n0 (/usr/lib64/libasan.so.4+0x7b8e2)\n1 in mlx5_devx_tir_attr_set ../drivers/net/mlx5/mlx5_devx.c:765\n2 in mlx5_devx_hrxq_new ../drivers/net/mlx5/mlx5_devx.c:800\n3 in mlx5_devx_drop_action_create ../drivers/net/mlx5/mlx5_devx.c:1051\n4 in mlx5_drop_action_create ../drivers/net/mlx5/mlx5_rxq.c:2846\n5 in mlx5_dev_spawn ../drivers/net/mlx5/linux/mlx5_os.c:1743\n6 in mlx5_os_pci_probe_pf ../drivers/net/mlx5/linux/mlx5_os.c:2501\n7 in mlx5_os_pci_probe ../drivers/net/mlx5/linux/mlx5_os.c:2647\n8 in mlx5_os_net_probe ../drivers/net/mlx5/linux/mlx5_os.c:2722\n9 in drivers_probe ../drivers/common/mlx5/mlx5_common.c:657\n10 in mlx5_common_dev_probe ../drivers/common/mlx5/mlx5_common.c:711\n11 in mlx5_common_pci_probe ../drivers/common/mlx5/mlx5_common_pci.c:150\n12 in rte_pci_probe_one_driver ../drivers/bus/pci/pci_common.c:269\n13 in pci_probe_all_drivers ../drivers/bus/pci/pci_common.c:353\n14 in pci_probe ../drivers/bus/pci/pci_common.c:380\n15 in rte_bus_probe ../lib/eal/common/eal_common_bus.c:72\n16 in rte_eal_init ../lib/eal/linux/eal.c:1286\n17 in main ../app/test-pmd/testpmd.c:4112\n\nFixes: 0c762e81da9b (\"net/mlx5: share Rx queue drop action code\")\nCc: stable@dpdk.org\n\nSigned-off-by: Yunjian Wang <wangyunjian@huawei.com>\n---\n drivers/net/mlx5/mlx5_rxq.c | 2 +-\n 1 file changed, 1 insertion(+), 1 deletion(-)", "diff": "diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c\nindex f77d42dedf..a1e0b887a8 100644\n--- a/drivers/net/mlx5/mlx5_rxq.c\n+++ b/drivers/net/mlx5/mlx5_rxq.c\n@@ -2828,7 +2828,7 @@ mlx5_drop_action_create(struct rte_eth_dev *dev)\n \n \tif (priv->drop_queue.hrxq)\n \t\treturn priv->drop_queue.hrxq;\n-\thrxq = mlx5_malloc(MLX5_MEM_ZERO, sizeof(*hrxq), 0, SOCKET_ID_ANY);\n+\thrxq = mlx5_malloc(MLX5_MEM_ZERO, sizeof(*hrxq) + MLX5_RSS_HASH_KEY_LEN, 0, SOCKET_ID_ANY);\n \tif (!hrxq) {\n \t\tDRV_LOG(WARNING,\n \t\t\t\"Port %u cannot allocate memory for drop queue.\",\n", "prefixes": [ "1/1" ] }