From mboxrd@z Thu Jan  1 00:00:00 1970
From: Chas Williams <3chas3@gmail.com>
Subject: Re: [PATCH 2/2] net/bonding: fix oob access in "other"
 aggregator modes
Date: Sun, 24 Mar 2019 13:24:00 -0400
Message-ID: <8eb07dc9-0640-66bd-22aa-e8518d449e97@gmail.com>
References: <1553200094-5487-1-git-send-email-david.marchand@redhat.com>
 <1553200094-5487-2-git-send-email-david.marchand@redhat.com>
 <615b76a3-ea73-19b7-c1b2-9ee1862473a6@gmail.com>
 <CAJFAV8wn0VAu41ZriTfUpXs4jLXeLxQz3=rCCOhfrvhNYPc+kQ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Cc: dev <dev@dpdk.org>, "Yigit, Ferruh" <ferruh.yigit@intel.com>,
 chas3@att.com, "Zhaohui (zhaohui, Polestar)" <zhaohui8@huawei.com>,
 dpdk stable <stable@dpdk.org>
To: David Marchand <david.marchand@redhat.com>
Return-path: <dev-bounces@dpdk.org>
In-Reply-To: <CAJFAV8wn0VAu41ZriTfUpXs4jLXeLxQz3=rCCOhfrvhNYPc+kQ@mail.gmail.com>
Content-Language: en-US
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>



On 3/24/19 1:11 PM, David Marchand wrote:
> On Sun, Mar 24, 2019 at 2:35 PM Chas Williams <3chas3@gmail.com 
> <mailto:3chas3@gmail.com>> wrote:
> 
>     Have you ever experienced this problem in practice? I ask because I am
>     considering some fixes that would limit the number of slaves to a more
>     reasonable number (and reduce the over stack usage of the bonding
>     driver
>     in general).
> 
> 
> Not too hard to reproduce, the problem is not the number of slaves.
> With a default RTE_MAX_ETHPORTS at 32, any slave whose portid >= 8 would 
> trigger an oob access.
Err... Well I have a lot of questions then about this whole thing.  What 
is max_index() doing?

                 mode_count_id = max_index(agg_count, slaves_count);

It's indexing up to slaves_count, which is likely to be somewhere around 
2. agg_count() is indexed by the port id. It's likely agg_count was 
intended to be indexed by the slave index and not the port id.

> 
> 
> Example:
> # git describe
> v19.02-294-gad2f555
> 
> # gdb ./master/app/testpmd
> (gdb) b selection_logic
> (gdb) run -c 0x3 --no-pci --vdev net_ring0 --vdev net_ring1 --vdev 
> net_ring2 --vdev net_ring3 --vdev net_ring4 --vdev net_ring5 --vdev 
> net_ring6 --vdev net_ring7 --vdev net_ring8 --vdev net_ring9 --vdev 
> net_bonding0,mode=4,slave=8,slave=9 -- -i --total-num-mbufs 2048
> 
> Breakpoint 1, selection_logic (internals=0x17fe51980, slave_id=8) at 
> /root/dpdk/drivers/net/bonding/rte_eth_bond_8023ad.c:670
> 670        uint16_t slaves_count, new_agg_id, i, j = 0;
> Missing separate debuginfos, use: debuginfo-install 
> glibc-2.17-260.el7_6.3.x86_64 libgcc-4.8.5-36.el7.x86_64 
> numactl-libs-2.0.9-7.el7.x86_64
> (gdb) n
> 672        uint64_t agg_bandwidth[8] = {0};
> (gdb)
> 673        uint64_t agg_count[8] = {0};
> (gdb)
> 674        uint16_t default_slave = 0;
> (gdb) p agg_bandwidth
> $1 = {0, 0, 0, 0, 0, 0, 0, 0}
> (gdb) p agg_count
> $2 = {0, 0, 0, 0, 0, 0, 0, 0}
> (gdb) n
> 678        slaves = internals->active_slaves;
> (gdb)
> 679        slaves_count = internals->active_slave_count;
> (gdb)
> 680        port = &bond_mode_8023ad_ports[slave_id];
> (gdb)
> 683        for (i = 0; i < slaves_count; ++i) {
> (gdb)
> 684            agg = &bond_mode_8023ad_ports[slaves[i]];
> (gdb)
> 686            if (agg->aggregator_port_id != slaves[i])
> (gdb)
> 689            agg_count[agg->aggregator_port_id] += 1;
> (gdb)
> 690            rte_eth_link_get_nowait(slaves[i], &link_info);
> (gdb) p agg_bandwidth
> $3 = {1, 0, 0, 0, 0, 0, 0, 0}
> (gdb) p agg_count
> $4 = {0, 0, 0, 0, 0, 0, 0, 0}
> 
> 
> -- 
> David Marchand