summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--build/external/patches/dpdk_18.08/0006-net-bonding-fix-buffer-corruption-in-packets.patch203
1 files changed, 203 insertions, 0 deletions
diff --git a/build/external/patches/dpdk_18.08/0006-net-bonding-fix-buffer-corruption-in-packets.patch b/build/external/patches/dpdk_18.08/0006-net-bonding-fix-buffer-corruption-in-packets.patch
new file mode 100644
index 00000000000..3a13a7dff00
--- /dev/null
+++ b/build/external/patches/dpdk_18.08/0006-net-bonding-fix-buffer-corruption-in-packets.patch
@@ -0,0 +1,203 @@
+commit 6b2a47d
+Author: Jia Yu <jyu@vmware.com>
+AuthorDate: Sun Aug 19 22:18:45 2018 -0700
+Commit: Ferruh Yigit <ferruh.yigit@intel.com>
+CommitDate: Tue Aug 28 15:27:39 2018 +0200
+
+ net/bonding: fix buffer corruption in packets
+
+ When bond slave devices cannot transmit all packets in bufs array,
+ tx_burst callback shall merge the un-transmitted packets back to
+ bufs array. Recent merge logic introduced a bug which causes
+ invalid mbuf addresses being written to bufs array.
+ When caller frees the un-transmitted packets, due to invalid addresses,
+ application will crash.
+
+ The fix is avoid shifting mbufs, and directly write un-transmitted
+ packets back to bufs array.
+
+ Fixes: 09150784a776 ("net/bonding: burst mode hash calculation")
+ Cc: stable@dpdk.org
+
+ Signed-off-by: Jia Yu <jyu@vmware.com>
+ Acked-by: Chas Williams <chas3@att.com>
+
+diff --git a/drivers/net/bonding/rte_eth_bond_pmd.c b/drivers/net/bonding/rte_eth_bond_pmd.c
+index 4417422..b84f322 100644
+--- a/drivers/net/bonding/rte_eth_bond_pmd.c
++++ b/drivers/net/bonding/rte_eth_bond_pmd.c
+@@ -301,10 +301,10 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs,
+ /* Mapping array generated by hash function to map mbufs to slaves */
+ uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
+
+- uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
++ uint16_t slave_tx_count;
+ uint16_t total_tx_count = 0, total_tx_fail_count = 0;
+
+- uint16_t i, j;
++ uint16_t i;
+
+ if (unlikely(nb_bufs == 0))
+ return 0;
+@@ -359,34 +359,12 @@ bond_ethdev_tx_burst_8023ad_fast_queue(void *queue, struct rte_mbuf **bufs,
+
+ /* If tx burst fails move packets to end of bufs */
+ if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
+- slave_tx_fail_count[i] = slave_nb_bufs[i] -
++ int slave_tx_fail_count = slave_nb_bufs[i] -
+ slave_tx_count;
+- total_tx_fail_count += slave_tx_fail_count[i];
+-
+- /*
+- * Shift bufs to beginning of array to allow reordering
+- * later
+- */
+- for (j = 0; j < slave_tx_fail_count[i]; j++) {
+- slave_bufs[i][j] =
+- slave_bufs[i][(slave_tx_count - 1) + j];
+- }
+- }
+- }
+-
+- /*
+- * If there are tx burst failures we move packets to end of bufs to
+- * preserve expected PMD behaviour of all failed transmitted being
+- * at the end of the input mbuf array
+- */
+- if (unlikely(total_tx_fail_count > 0)) {
+- int bufs_idx = nb_bufs - total_tx_fail_count - 1;
+-
+- for (i = 0; i < slave_count; i++) {
+- if (slave_tx_fail_count[i] > 0) {
+- for (j = 0; j < slave_tx_fail_count[i]; j++)
+- bufs[bufs_idx++] = slave_bufs[i][j];
+- }
++ total_tx_fail_count += slave_tx_fail_count;
++ memcpy(&bufs[nb_bufs - total_tx_fail_count],
++ &slave_bufs[i][slave_tx_count],
++ slave_tx_fail_count * sizeof(bufs[0]));
+ }
+ }
+
+@@ -716,8 +694,8 @@ bond_ethdev_tx_burst_round_robin(void *queue, struct rte_mbuf **bufs,
+ tx_fail_total += tx_fail_slave;
+
+ memcpy(&bufs[nb_pkts - tx_fail_total],
+- &slave_bufs[i][num_tx_slave],
+- tx_fail_slave * sizeof(bufs[0]));
++ &slave_bufs[i][num_tx_slave],
++ tx_fail_slave * sizeof(bufs[0]));
+ }
+ num_tx_total += num_tx_slave;
+ }
+@@ -1222,10 +1200,10 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs,
+ /* Mapping array generated by hash function to map mbufs to slaves */
+ uint16_t bufs_slave_port_idxs[nb_bufs];
+
+- uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
++ uint16_t slave_tx_count;
+ uint16_t total_tx_count = 0, total_tx_fail_count = 0;
+
+- uint16_t i, j;
++ uint16_t i;
+
+ if (unlikely(nb_bufs == 0))
+ return 0;
+@@ -1266,34 +1244,12 @@ bond_ethdev_tx_burst_balance(void *queue, struct rte_mbuf **bufs,
+
+ /* If tx burst fails move packets to end of bufs */
+ if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
+- slave_tx_fail_count[i] = slave_nb_bufs[i] -
++ int slave_tx_fail_count = slave_nb_bufs[i] -
+ slave_tx_count;
+- total_tx_fail_count += slave_tx_fail_count[i];
+-
+- /*
+- * Shift bufs to beginning of array to allow reordering
+- * later
+- */
+- for (j = 0; j < slave_tx_fail_count[i]; j++) {
+- slave_bufs[i][j] =
+- slave_bufs[i][(slave_tx_count - 1) + j];
+- }
+- }
+- }
+-
+- /*
+- * If there are tx burst failures we move packets to end of bufs to
+- * preserve expected PMD behaviour of all failed transmitted being
+- * at the end of the input mbuf array
+- */
+- if (unlikely(total_tx_fail_count > 0)) {
+- int bufs_idx = nb_bufs - total_tx_fail_count - 1;
+-
+- for (i = 0; i < slave_count; i++) {
+- if (slave_tx_fail_count[i] > 0) {
+- for (j = 0; j < slave_tx_fail_count[i]; j++)
+- bufs[bufs_idx++] = slave_bufs[i][j];
+- }
++ total_tx_fail_count += slave_tx_fail_count;
++ memcpy(&bufs[nb_bufs - total_tx_fail_count],
++ &slave_bufs[i][slave_tx_count],
++ slave_tx_fail_count * sizeof(bufs[0]));
+ }
+ }
+
+@@ -1320,10 +1276,10 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs,
+ /* Mapping array generated by hash function to map mbufs to slaves */
+ uint16_t bufs_slave_port_idxs[RTE_MAX_ETHPORTS] = { 0 };
+
+- uint16_t slave_tx_count, slave_tx_fail_count[RTE_MAX_ETHPORTS] = { 0 };
++ uint16_t slave_tx_count;
+ uint16_t total_tx_count = 0, total_tx_fail_count = 0;
+
+- uint16_t i, j;
++ uint16_t i;
+
+ if (unlikely(nb_bufs == 0))
+ return 0;
+@@ -1381,39 +1337,13 @@ bond_ethdev_tx_burst_8023ad(void *queue, struct rte_mbuf **bufs,
+
+ /* If tx burst fails move packets to end of bufs */
+ if (unlikely(slave_tx_count < slave_nb_bufs[i])) {
+- slave_tx_fail_count[i] = slave_nb_bufs[i] -
++ int slave_tx_fail_count = slave_nb_bufs[i] -
+ slave_tx_count;
+- total_tx_fail_count += slave_tx_fail_count[i];
+-
+- /*
+- * Shift bufs to beginning of array to allow
+- * reordering later
+- */
+- for (j = 0; j < slave_tx_fail_count[i]; j++)
+- slave_bufs[i][j] =
+- slave_bufs[i]
+- [(slave_tx_count - 1)
+- + j];
+- }
+- }
++ total_tx_fail_count += slave_tx_fail_count;
+
+- /*
+- * If there are tx burst failures we move packets to end of
+- * bufs to preserve expected PMD behaviour of all failed
+- * transmitted being at the end of the input mbuf array
+- */
+- if (unlikely(total_tx_fail_count > 0)) {
+- int bufs_idx = nb_bufs - total_tx_fail_count - 1;
+-
+- for (i = 0; i < slave_count; i++) {
+- if (slave_tx_fail_count[i] > 0) {
+- for (j = 0;
+- j < slave_tx_fail_count[i];
+- j++) {
+- bufs[bufs_idx++] =
+- slave_bufs[i][j];
+- }
+- }
++ memcpy(&bufs[nb_bufs - total_tx_fail_count],
++ &slave_bufs[i][slave_tx_count],
++ slave_tx_fail_count * sizeof(bufs[0]));
+ }
+ }
+ }