app/testpmd: fix segment fault with invalid queue id
Checks
Commit Message
When input queue id is invalid, it will lead to
Segmentation fault, like:
dpdk-testpmd -a 0000:01:00.0 -- -i
testpmd> show port 0 txq/rxq 99 desc 0 status
Segmentation fault
dpdk-testpmd -a 0000:01:00.0 -- -i
testpmd> show port 0 rxq 99 desc used count
Segmentation fault
This patch fixes it.
In addition, this patch add the check for the offset
of the descriptor in case of other anomalies.
Fixes: fae9aa717d6c ("app/testpmd: support checking descriptor status")
Fixes: 3f9acb5c83bb ("ethdev: avoid non-dataplane checks in Rx queue count")
Cc: stable@dpdk.org
Signed-off-by: Dengdui Huang <huangdengdui@huawei.com>
---
app/test-pmd/cmdline.c | 50 ++++++++++++++++++++++++++++++++++++------
1 file changed, 43 insertions(+), 7 deletions(-)
Comments
On Tue, 16 May 2023 19:00:21 +0800
Dengdui Huang <huangdengdui@huawei.com> wrote:
> When input queue id is invalid, it will lead to
> Segmentation fault, like:
>
> dpdk-testpmd -a 0000:01:00.0 -- -i
> testpmd> show port 0 txq/rxq 99 desc 0 status
> Segmentation fault
>
> dpdk-testpmd -a 0000:01:00.0 -- -i
> testpmd> show port 0 rxq 99 desc used count
> Segmentation fault
>
> This patch fixes it.
>
> In addition, this patch add the check for the offset
> of the descriptor in case of other anomalies.
>
> Fixes: fae9aa717d6c ("app/testpmd: support checking descriptor status")
> Fixes: 3f9acb5c83bb ("ethdev: avoid non-dataplane checks in Rx queue count")
> Cc: stable@dpdk.org
>
> Signed-off-by: Dengdui Huang <huangdengdui@huawei.com>
What is the backtrace and device driver? The problem is that other users
besides testpmd might hit same problem.
It would make sense to have a function to test for valid rx and tx queue id
in rte_ethdev. Similar to existing rte_eth_dev_is_valid_port() rather than
open coding it. Maybe rte_eth_dev_is_valid_rxq(port_id, queue_id)?
here was talk that the existing rx queue descriptor status is racy, and
unused by any real application; and therefore would be good candidate for
future removal.
On 2023/5/16 23:12, Stephen Hemminger wrote:
> On Tue, 16 May 2023 19:00:21 +0800
> Dengdui Huang <huangdengdui@huawei.com> wrote:
>
>> When input queue id is invalid, it will lead to
>> Segmentation fault, like:
>>
>> dpdk-testpmd -a 0000:01:00.0 -- -i
>> testpmd> show port 0 txq/rxq 99 desc 0 status
>> Segmentation fault
>>
>> dpdk-testpmd -a 0000:01:00.0 -- -i
>> testpmd> show port 0 rxq 99 desc used count
>> Segmentation fault
>>
>> This patch fixes it.
>>
>> In addition, this patch add the check for the offset
>> of the descriptor in case of other anomalies.
>>
>> Fixes: fae9aa717d6c ("app/testpmd: support checking descriptor status")
>> Fixes: 3f9acb5c83bb ("ethdev: avoid non-dataplane checks in Rx queue count")
>> Cc: stable@dpdk.org
>>
>> Signed-off-by: Dengdui Huang <huangdengdui@huawei.com>
>
> What is the backtrace and device driver? The problem is that other users
> besides testpmd might hit same problem.
>
> It would make sense to have a function to test for valid rx and tx queue id
> in rte_ethdev. Similar to existing rte_eth_dev_is_valid_port() rather than
> open coding it. Maybe rte_eth_dev_is_valid_rxq(port_id, queue_id)?
>
> here was talk that the existing rx queue descriptor status is racy, and
> unused by any real application; and therefore would be good candidate for
> future removal.
Hi, Stephen
OK.
Agreed. But these APIs are still in dpdk, so testpmd as user side should use them correctly.
Thanks,
Dengdui
@@ -12273,14 +12273,27 @@ cmd_show_rx_tx_desc_status_parsed(void *parsed_result,
__rte_unused void *data)
{
struct cmd_show_rx_tx_desc_status_result *res = parsed_result;
+ struct rte_eth_rxq_info rxq_info;
+ struct rte_eth_txq_info txq_info;
int rc;
- if (!rte_eth_dev_is_valid_port(res->cmd_pid)) {
- fprintf(stderr, "invalid port id %u\n", res->cmd_pid);
- return;
- }
-
if (!strcmp(res->cmd_keyword, "rxq")) {
+ if (rte_eth_rx_queue_info_get(res->cmd_pid, res->cmd_qid, &rxq_info)) {
+ fprintf(stderr, "Failed to get port %u Rx queue %u info\n",
+ res->cmd_pid, res->cmd_qid);
+ return;
+ }
+
+ if (rxq_info.queue_state != RTE_ETH_QUEUE_STATE_STARTED) {
+ fprintf(stderr, "Rx queue %u not started\n", res->cmd_qid);
+ return;
+ }
+
+ if (res->cmd_did >= rxq_info.nb_desc) {
+ fprintf(stderr, "Invalid desc id %u\n", res->cmd_did);
+ return;
+ }
+
rc = rte_eth_rx_descriptor_status(res->cmd_pid, res->cmd_qid,
res->cmd_did);
if (rc < 0) {
@@ -12296,6 +12309,22 @@ cmd_show_rx_tx_desc_status_parsed(void *parsed_result,
else
printf("Desc status = UNAVAILABLE\n");
} else if (!strcmp(res->cmd_keyword, "txq")) {
+ if (rte_eth_tx_queue_info_get(res->cmd_pid, res->cmd_qid, &txq_info)) {
+ fprintf(stderr, "Failed to get port %u Tx queue %u info\n",
+ res->cmd_pid, res->cmd_qid);
+ return;
+ }
+
+ if (txq_info.queue_state != RTE_ETH_QUEUE_STATE_STARTED) {
+ fprintf(stderr, "Tx queue %u not started\n", res->cmd_qid);
+ return;
+ }
+
+ if (res->cmd_did >= txq_info.nb_desc) {
+ fprintf(stderr, "Invalid desc id %u\n", res->cmd_did);
+ return;
+ }
+
rc = rte_eth_tx_descriptor_status(res->cmd_pid, res->cmd_qid,
res->cmd_did);
if (rc < 0) {
@@ -12373,10 +12402,17 @@ cmd_show_rx_queue_desc_used_count_parsed(void *parsed_result,
__rte_unused void *data)
{
struct cmd_show_rx_queue_desc_used_count_result *res = parsed_result;
+ struct rte_eth_rxq_info rxq_info;
int rc;
- if (!rte_eth_dev_is_valid_port(res->cmd_pid)) {
- fprintf(stderr, "invalid port id %u\n", res->cmd_pid);
+ if (rte_eth_rx_queue_info_get(res->cmd_pid, res->cmd_qid, &rxq_info)) {
+ fprintf(stderr, "Failed to get port %u Rx queue %u info\n",
+ res->cmd_pid, res->cmd_qid);
+ return;
+ }
+
+ if (rxq_info.queue_state != RTE_ETH_QUEUE_STATE_STARTED) {
+ fprintf(stderr, "Rx queue %u not started\n", res->cmd_qid);
return;
}