Age | Commit message (Collapse) | Author | Files | Lines |
|
The main interior graph-node dispatch loop had a longstanding dangling
vector element reference:
for (i = 0; i < _vec_len (nm->pending_frames); i++)
cpu_time_now = dispatch_pending_node (vm, nm->pending_frames + i,
cpu_time_now);
Passing a pointer to a vector element (nm->pending_frames + i) has
considerable comedic potential if there's any chance that the vector
could expand.
dispatch_pending_node() calls dispatch_node(), and indirectly any
interior graph node dispatch function. If that node happens to expand
nm->pending_frames by filling in a new frame, nm->pending_frames can
expand.
After calling the node dispatch function, dispatch_node() does the
following:
nf = vec_elt_at_index (nm->next_frames, p->next_frame_index);
If nm->pending_frames expands during dispatch function execution, p is
a dangling reference to freed memory.
By luck, the TCP stack managed to allocate a fresh frame which
included "old-p," which caused p->next_frame_index to be filled with
the new-frame poison pattern 0xfefefefe.
This has been broken from day 1, summer 2007, first use of the
third-generation vector processing library.
Change-Id: Ideb6363bb060c4e8bf9b901882c318bd83853121
Signed-off-by: Dave Barach <dave@barachs.net>
|
|
Fixes VPP-872 and adds support for End.T
Change-Id: I3c32cb6e412f37babe1abd293c0b6b49367fc2a9
Signed-off-by: Pablo Camarillo <pcamaril@cisco.com>
|
|
Attempting to supply within a VAT CLI to add the ACLs a rule count
override with no rules to add would result in null pointer dereference
as we attempt to copy those rules to the message.
Add the check to avoid copy if the source pointer is null
(i.e. if there are no rules to copy from).
This commit fixes coverity errors 166797 and 166792.
Change-Id: Icabe060d961ba07dc41f63b8e17fca12ff82aa29
Signed-off-by: Andrew Yourtchenko <ayourtch@gmail.com>
|
|
- Fix buffer trace from esp_decrypt node
- Fix VLIB_REGISTER_NODE macro format
- Remove unnecessary code since we do not reconfigure graph
unless requirements are met
Change-Id: Ic1c2afffb8265e40a6ced0c8a58775c05fadc9e2
Signed-off-by: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
|
|
CID 161044 and 161045
Change-Id: I50a450e231e387f05e354e3b07dc777ab864d018
Signed-off-by: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
|
|
Change-Id: I01dc439fc84f9213e55ba56982eff34474637115
Signed-off-by: Milan Lenco <milan.lenco@pantheon.tech>
|
|
Change-Id: I586a758a8b4b0ea5ca030b2df2796f5acb49e154
Signed-off-by: Neale Ranns <nranns@cisco.com>
|
|
Change-Id: I21b1ad39275495d4d006023b58f630a213445854
Signed-off-by: Neale Ranns <nranns@cisco.com>
|
|
Change-Id: I5f7dc38beb96b600be67599049f951d8a17ff8da
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
|
|
- update of CSIT operational branch to be used for VPP-patch test
Change-Id: I49396105470609422f28a49211012fcd9f252587
Signed-off-by: Jan Gelety <jgelety@cisco.com>
|
|
Change-Id: I0324f945bdb4dd3b19151be6f3ce24a47a000104
Signed-off-by: Hongjun Ni <hongjun.ni@intel.com>
|
|
Change-Id: Ib22ffee3d8ac63af171d032c2ffcb44a2e42400c
Signed-off-by: Florin Coras <fcoras@cisco.com>
|
|
Change-Id: Ia78e69e5e8ed18020314aef321b94ac37037799b
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: I9eca5f9d1c1ae62d5ba5fb36f2f97434dbaf334e
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: Ieafd00c7d03fe5c090808c7af4aa2f86974a092e
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: I9d63133bd1db72917571ade868040c4597c896a1
Signed-off-by: Matus Fabian <matfabia@cisco.com>
|
|
The Wmaybe-uninitialized is the new error included with Wall.
This patch addresses the warning and fixes it.
Change-Id: I8fdf9ff2d236c46b717024a14874fbbbad8af303
Signed-off-by: Marco Varlese <marco.varlese@suse.com>
|
|
Change-Id: I4fc45097cb994ab6a59503d9fcfb693d1c7ec442
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
|
|
Change-Id: Ifcd6d2caecce29c8b4605d06b9df82b36a403e74
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
|
|
Change-Id: I76d399915c76ec68d8a401e11c14dc15c55291e4
Signed-off-by: wenxian li <wofanli@gmail.com>
|
|
When building VPP code with gcc7 a warning (threated as error) is encountered and the build fails.
This patch addressed the compilation issue.
Change-Id: I49af9288a84d91ec8145da07c00aefb5333ec418
Signed-off-by: Marco Varlese <marco.varlese@suse.com>
|
|
VPP crash is observed when MAC aging is enabled with multi-threaded mode.
If a thread other-than-zero expands the working_copies vector,
working_copy_lengths should be initialized with vec_validate_init_empty(..., -1)
to fill -1 across lower-numbered working_copy_lengths vector element.
Change-Id: I60959fc6511306b33acae323df9c6898fc6c50ce
Signed-off-by: Steve Shin <jonshin@cisco.com>
|
|
Check -1 for return from read prior to using the data
Change-Id: Ibab7309244de488737ea7938b334fab495bf855d
Signed-off-by: Steven <sluong@cisco.com>
|
|
Change-Id: Ibf15eeb5fef2a3761089e6386783a1606d2e2b79
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
Change-Id: I03f73615f4355163afd9fb5062dcea7c2df5a49a
Signed-off-by: khers <s3m2e1.6star@gmail.com>
|
|
Change-Id: I33de2948019683961b5ab576db2c3303c8d2bd5e
Signed-off-by: Peter Mikus <pmikus@cisco.com>
|
|
Add runtime debug vhost-user on | off CLI to facilitate troubleshooting.
This feature is needed to avoid recompiling the code to debug vhost issues.
The debugging messages should not be on the data path to avoid performance
hit.
Change-Id: I4c40f65dbb222557cba3fb8706fa3b7b62eec95f
Signed-off-by: Steven <sluong@cisco.com>
|
|
Change-Id: Ic3c8cd58cb2b02622299cf74c9efcabd2ef2b513
Signed-off-by: Hongjun Ni <hongjun.ni@intel.com>
|
|
Change-Id: Ib874ad93357500b2c425d75cf48834264b2183fc
Signed-off-by: Neale Ranns <nranns@cisco.com>
|
|
Change-Id: I6c3fd612c19d9305f48ae0e429e12e96679e3b29
Signed-off-by: Neale Ranns <nranns@cisco.com>
|
|
This patch allows to use the "make install-dep" on openSUSE.
Change-Id: Ib0586ffebbf882032468e4f4c0df2d5d8e99d7c9
Signed-off-by: Marco Varlese <marco.varlese@suse.com>
|
|
Change-Id: Ie5b88fd7187ed62218a2e4e0e493c33e3e9ecc2f
Signed-off-by: Neale Ranns <nranns@cisco.com>
|
|
- add option to preallocate fifos in a segment
- track active fifos with doubly linked list instead of vector
- update udp redirect test code to read fifo pointers from API call
instead of digging them up from fifo segment header
- input-node based active-open session generator
Change-Id: I804b81e99d95f8690d17e12660c6645995e28a9a
Signed-off-by: Dave Barach <dave@barachs.net>
Signed-off-by: Florin Coras <fcoras@cisco.com>
Signed-off-by: Dave Barach <dbarach@cisco.com>
|
|
Change-Id: I121eaee6b752a6b3bfe1d5ecf803f67147c77beb
Signed-off-by: Klement Sekera <ksekera@cisco.com>
|
|
This reverts commit 0e2e10b77d63196bfb93ae5be1251bbc1a1b561a.
Change-Id: I3c1737f391b6ed127f92416f06449216e79859bb
Signed-off-by: Peter Mikus <pmikus@cisco.com>
|
|
- Add rx-queues and tx-queues option to the create memif CLI
- Add vlib_worker_thread_barrier_sync () to memif_conn_fd_read_ready () as
the latter function may disconnect the ring and clean up the shared memory.
- On transmit, write the rid (queue number) to the socket.
- On receive, read the rid and trigger the interrupt for the corresponding
thread.
Change-Id: If1c7e26c7124174678f047909cbc33e931eaac8c
Signed-off-by: Steven <sluong@cisco.com>
|
|
This reverts commit 9757325c52c223d85abfad834b071077365d4808.
Change-Id: I3bee0fe7d48be723334f2bd9fffd3240658b9e71
Signed-off-by: Dave Wallace <dwallacelf@gmail.com>
|
|
Change-Id: I67839281623721bf42f0a918a53356143d9dc78a
Signed-off-by: Ole Troan <ot@cisco.com>
Signed-off-by: Pavel Kotucek <pkotucek@cisco.com>
Signed-off-by: Ole Troan <ot@cisco.com>
|
|
Change-Id: Ica95b5d3d44563c93c89b2a3233171c3aa1f048d
Signed-off-by: Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
|
|
Change-Id: I1ec328cda73f7eaf7867cd8a2a17852ee0cd23f1
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
|
|
- Move Coverity scripts from build-root/scripts to extras/scripts
- Update coverity-build with new path and add some comments
Change-Id: I1be8069fb574aaacbac9b7f2c9c80b9aad1790ec
Signed-off-by: Chris Luke <chrisy@flirble.org>
|
|
- update of CSIT operational branch to be used for VPP-patch test
Change-Id: I66357690f41e23dd1b924cc50a951a6c3696e071
Signed-off-by: Jan Gelety <jgelety@cisco.com>
|
|
Change-Id: I805800503f5330c14d2e654c02bf43e21e7ce917
Signed-off-by: Damjan Marion <damarion@cisco.com>
|
|
When I type in 'quit' on the slave instance, the master instance crashes
on this line.
0: /home/sluong/vpp-master/vpp/build-data/../src/vlib/unix/input.c:200 (linux_epoll_input) assertion `! pool_is_free (um->file_pool, _e)' fails
Aborted (core dumped)
Below is the decode from gdb
line_number=0, fmt=0x7f57af6cc9a0 "%s:%d (%s) assertion `%s' fails")
at /home/sluong/vpp-master/vpp/build-data/../src/vppinfra/error.c:143
vm=0x7f57af8e2400 <vlib_global_main>, node=0x7f576d40ad80, frame=0x0)
at /home/sluong/vpp-master/vpp/build-data/../src/vlib/unix/input.c:200
vm=0x7f57af8e2400 <vlib_global_main>, node=0x7f576d40ad80,
type=VLIB_NODE_TYPE_PRE_INPUT, dispatch_state=VLIB_NODE_STATE_POLLING,
frame=0x0, last_time_stamp=1525665215050617)
at /home/sluong/vpp-master/vpp/build-data/../src/vlib/main.c:1016
vm=0x7f57af8e2400 <vlib_global_main>, is_main=1)
at /home/sluong/vpp-master/vpp/build-data/../src/vlib/main.c:1500
I am able to reproduce the problem consistently with the below procedure.
1. Create 3 memif interfaces between slave and master instances.
2. Type 'quit' on the slave. Neither crashes the first time.
3. Bring back the slave. Type 'quit' on the master. Neither crashes.
4. Bring back the master. Type 'quit' on the slave. The master crashes.
There are two places the interrupt line is disconnected and the unix file is
removed via the call unix_file_del ()
1. memif_int_fd_read_ready ()
2. memif_disconnect () which is called via multiple places in memif.
When the crash happens, the unix file was removed from memif_disconnect ()
via memif_conn_fd_read_ready () with size of the message == 0 in recvmsg ().
It is noted when the unix file was removed from memif_int_fd_read_ready (),
it never crashes. It is a race condition. However, if I follow the
aformentioned procedure, the crash always happens.
The reason the crash happens when memif_disconnect () removes the unix file
is because there may still be pending input in linux_epoll_input (). When
linux_epoll_input () tries to access the unix file via the line 200
unix_file_t *f = pool_elt_at_index (um->file_pool, i);
it crashes.
We could add code in linux_epoll_input () to avoid the crash if the index
for the particular file_pool is already free. Or we could fix memif to not
remove the unix file in memif_conn_fd_read_ready () when recvmsg () got 0
byte and just postpone the unix file deletion in memif_int_fd_read_ready ()
later after linux_epoll_input () got a chance to run to empty the input
stream.
I choose to fix the problem in the latter approach. I split the function
memif_disconnect () into two parts. For the code path which
memif_conn_fd_read_ready () calls memif_disconnect (), it does not remove the
unix file. All other calls to memif_disconnect () will continue to do what
it uses to do to avoid regression.
Please let me know if I should fix the problem other way.
Change-Id: I8efe2a3d24c6581609bc7b6fe82c2b59c22d8e4b
Signed-off-by: Steven <sluong@cisco.com>
|
|
Change-Id: I7972273d0e9bd36e3fd6e12ab0268341ba572313
Signed-off-by: Burt Silverman <burtms@gmail.com>
|
|
Change-Id: I7de6b96631d1645d0eadd38525860d84d78e316d
Signed-off-by: Neale Ranns <nranns@cisco.com>
|
|
don't add duplicate extensions.
Change-Id: Icf72d6e1b004d0dda532bec2b51f6b74544925bb
Signed-off-by: Neale Ranns <nranns@cisco.com>
|
|
Since all objects of the array have the same type, the object
constructor is a loop invariant. Move the lookup out of the loop,
making things faster.
Change-Id: I631c72b59c6c63eccd49ede41c6dc0541c325db9
Signed-off-by: Robert Varga <robert.varga@pantheon.tech>
Signed-off-by: Robert Varga <nite@hq.sk>
|
|
Change-Id: I50a0cbc7d8ecc94ad494df4720bb4199673e9793
Signed-off-by: Filip Tehlar <ftehlar@cisco.com>
|
|
The JNI templates around array and object handling are wrong in the
sense that they fail to delete local references for objects which
have been assigned to fields/arrays. Fix this by invoking
DeleteLocalRef.
Change-Id: I1c31d81f4235d821ccd51c96be7b176f64284928
Signed-off-by: Robert Varga <robert.varga@pantheon.tech>
Signed-off-by: Robert Varga <nite@hq.sk>
|