dpdk: net/bonding: fix buffer corruption in packets

This fix is needed for setup with bonded interfaces.
In some scenarios vpp might crash, this change fixes the issue.

Change-Id: I0dc66e32b6c89dc3f8d552401833d6785a12c978
Signed-off-by: Igor Mikhailov (imichail) <imichail@cisco.com>

1 files changed, 203 insertions, 0 deletions

diff --git a/build/external/patches/dpdk_18.08/0006-net-bonding-fix-buffer-corruption-in-packets.patch b/build/external/patches/dpdk_18.08/0006-net-bonding-fix-buffer-corruption-in-packets.patch
new file mode 100644
index 00000000000..3a13a7dff00
--- /dev/null
+++ b/build/external/patches/dpdk_18.08/0006-net-bonding-fix-buffer-corruption-in-packets.patch
@@ -0,0 +1,203 @@
+commit 6b2a47d
+Author:     Jia Yu <jyu@vmware.com>
+AuthorDate: Sun Aug 19 22:18:45 2018 -0700
+Commit:     Ferruh Yigit <ferruh.yigit@intel.com>
+CommitDate: Tue Aug 28 15:27:39 2018 +0200
+
+    net/bonding: fix buffer corruption in packets
+    
+    When bond slave devices cannot transmit all packets in bufs array,
+    tx_burst callback shall merge the un-transmitted packets back to
+    bufs array. Recent merge logic introduced a bug which causes
+    invalid mbuf addresses being written to bufs array.
+    When caller frees the un-transmitted packets, due to invalid addresses,
+    application will crash.
+    
+    The fix is avoid shifting mbufs, and directly write un-transmitted
+    packets back to bufs array.
+    
+    Fixes: 09150784a776 ("net/bonding: burst mode hash calculation")
+    Cc: stable@dpdk.org
+    
+    Signed-off-by: Jia Yu <jyu@vmware.com>
+    Acked-by: Chas Williams <chas3@att.com>
+
+diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c
+index 4417422..b84f322 100644
+--- a/drivers/net/bonding/rte_eth_bond_pmd.c
++++ b/drivers/net/bonding/rte_eth_bond_pmd.c
+@@ -301,10 +301,10 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs,
+ 	/* Mapping array generated by hash function to map mbufs to slaves */
+ 	uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
+ 
+-	uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
++	uint16_t slave_tx_count;
+ 	uint16_t total_tx_count = 0, total_tx_fail_count = 0;
+ 
+-	uint16_t i, j;
++	uint16_t i;
+ 
+ 	if (unlikely(nb_bufs == 0))
+ 		return 0;
+@@ -359,34 +359,12 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs,
+ 
+ 		/* If tx burst fails move packets to end of bufs */
+ 		if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
+-			slave_tx_fail_count[i] = slave_nb_bufs[i] -
++			int slave_tx_fail_count = slave_nb_bufs[i] -
+ 					slave_tx_count;
+-			total_tx_fail_count += slave_tx_fail_count[i];
+-
+-			/*
+-			 * Shift bufs to beginning of array to allow reordering
+-			 * later
+-			 */
+-			for (j = 0; j < slave_tx_fail_count[i]; j++) {
+-				slave_bufs[i][j] =
+-					slave_bufs[i][(slave_tx_count - 1) + j];
+-			}
+-		}
+-	}
+-
+-	/*
+-	 * If there are tx burst failures we move packets to end of bufs to
+-	 * preserve expected PMD behaviour of all failed transmitted being
+-	 * at the end of the input mbuf array
+-	 */
+-	if (unlikely(total_tx_fail_count > 0)) {
+-		int bufs_idx = nb_bufs - total_tx_fail_count - 1;
+-
+-		for (i = 0; i < slave_count; i++) {
+-			if (slave_tx_fail_count[i] > 0) {
+-				for (j = 0; j < slave_tx_fail_count[i]; j++)
+-					bufs[bufs_idx++] = slave_bufs[i][j];
+-			}
++			total_tx_fail_count += slave_tx_fail_count;
++			memcpy(&bufs[nb_bufs - total_tx_fail_count],
++			       &slave_bufs[i][slave_tx_count],
++			       slave_tx_fail_count * sizeof(bufs[0]));
+ 		}
+ 	}
+ 
+@@ -716,8 +694,8 @@ bond_ethdev_tx_burst_round_robin(void *queue, struct rte_mbuf **bufs,
+ 				tx_fail_total += tx_fail_slave;
+ 
+ 				memcpy(&bufs[nb_pkts - tx_fail_total],
+-						&slave_bufs[i][num_tx_slave],
+-						tx_fail_slave * sizeof(bufs[0]));
++				       &slave_bufs[i][num_tx_slave],
++				       tx_fail_slave * sizeof(bufs[0]));
+ 			}
+ 			num_tx_total += num_tx_slave;
+ 		}
+@@ -1222,10 +1200,10 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs,
+ 	/* Mapping array generated by hash function to map mbufs to slaves */
+ 	uint16_t bufs_slave_port_idxs[nb_bufs];
+ 
+-	uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
++	uint16_t slave_tx_count;
+ 	uint16_t total_tx_count = 0, total_tx_fail_count = 0;
+ 
+-	uint16_t i, j;
++	uint16_t i;
+ 
+ 	if (unlikely(nb_bufs == 0))
+ 		return 0;
+@@ -1266,34 +1244,12 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs,
+ 
+ 		/* If tx burst fails move packets to end of bufs */
+ 		if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
+-			slave_tx_fail_count[i] = slave_nb_bufs[i] -
++			int slave_tx_fail_count = slave_nb_bufs[i] -
+ 					slave_tx_count;
+-			total_tx_fail_count += slave_tx_fail_count[i];
+-
+-			/*
+-			 * Shift bufs to beginning of array to allow reordering
+-			 * later
+-			 */
+-			for (j = 0; j < slave_tx_fail_count[i]; j++) {
+-				slave_bufs[i][j] =
+-					slave_bufs[i][(slave_tx_count - 1) + j];
+-			}
+-		}
+-	}
+-
+-	/*
+-	 * If there are tx burst failures we move packets to end of bufs to
+-	 * preserve expected PMD behaviour of all failed transmitted being
+-	 * at the end of the input mbuf array
+-	 */
+-	if (unlikely(total_tx_fail_count > 0)) {
+-		int bufs_idx = nb_bufs - total_tx_fail_count - 1;
+-
+-		for (i = 0; i < slave_count; i++) {
+-			if (slave_tx_fail_count[i] > 0) {
+-				for (j = 0; j < slave_tx_fail_count[i]; j++)
+-					bufs[bufs_idx++] = slave_bufs[i][j];
+-			}
++			total_tx_fail_count += slave_tx_fail_count;
++			memcpy(&bufs[nb_bufs - total_tx_fail_count],
++			       &slave_bufs[i][slave_tx_count],
++			       slave_tx_fail_count * sizeof(bufs[0]));
+ 		}
+ 	}
+ 
+@@ -1320,10 +1276,10 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs,
+ 	/* Mapping array generated by hash function to map mbufs to slaves */
+ 	uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
+ 
+-	uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
++	uint16_t slave_tx_count;
+ 	uint16_t total_tx_count = 0, total_tx_fail_count = 0;
+ 
+-	uint16_t i, j;
++	uint16_t i;
+ 
+ 	if (unlikely(nb_bufs == 0))
+ 		return 0;
+@@ -1381,39 +1337,13 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs,
+ 
+ 			/* If tx burst fails move packets to end of bufs */
+ 			if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
+-				slave_tx_fail_count[i] = slave_nb_bufs[i] -
++				int slave_tx_fail_count = slave_nb_bufs[i] -
+ 						slave_tx_count;
+-				total_tx_fail_count += slave_tx_fail_count[i];
+-
+-				/*
+-				 * Shift bufs to beginning of array to allow
+-				 * reordering later
+-				 */
+-				for (j = 0; j < slave_tx_fail_count[i]; j++)
+-					slave_bufs[i][j] =
+-						slave_bufs[i]
+-							[(slave_tx_count - 1)
+-							+ j];
+-			}
+-		}
++				total_tx_fail_count += slave_tx_fail_count;
+ 
+-		/*
+-		 * If there are tx burst failures we move packets to end of
+-		 * bufs to preserve expected PMD behaviour of all failed
+-		 * transmitted being at the end of the input mbuf array
+-		 */
+-		if (unlikely(total_tx_fail_count > 0)) {
+-			int bufs_idx = nb_bufs - total_tx_fail_count - 1;
+-
+-			for (i = 0; i < slave_count; i++) {
+-				if (slave_tx_fail_count[i] > 0) {
+-					for (j = 0;
+-						j < slave_tx_fail_count[i];
+-						j++) {
+-						bufs[bufs_idx++] =
+-							slave_bufs[i][j];
+-					}
+-				}
++				memcpy(&bufs[nb_bufs - total_tx_fail_count],
++				       &slave_bufs[i][slave_tx_count],
++				       slave_tx_fail_count * sizeof(bufs[0]));
+ 			}
+ 		}
+ 	}