From: bugzilla@dpdk.org
To: dev@dpdk.org
Subject: [dpdk-dev] [Bug 602] rte_jhash: reading past end of stack
Date: Tue, 15 Dec 2020 23:06:02 +0000 [thread overview]
Message-ID: <bug-602-3@http.bugs.dpdk.org/> (raw)
https://bugs.dpdk.org/show_bug.cgi?id=602
Bug ID: 602
Summary: rte_jhash: reading past end of stack
Product: DPDK
Version: 20.11
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: other
Assignee: dev@dpdk.org
Reporter: stephen@networkplumber.org
Target Milestone: ---
Created attachment 138
--> https://bugs.dpdk.org/attachment.cgi?id=138&action=edit
Demo of rte_jhash bug
Build the attached program with address-santize option on any architecture but
x86.
Run with:
$ jhash_demo 1.1.1.1 123
=================================================================
==23990==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xffffe98f86c0 at pc 0xab6b23a9cb08 bp 0xffffe98f84c0 sp 0xffffe98f84e0
READ of size 4 at 0xffffe98f86c0 thread T0
#0 0xab6b23a9cb07 in __rte_jhash_2hashes (/tmp/jhash_demo+0x1b07)
#1 0xab6b23a9e943 in rte_jhash_2hashes (/tmp/jhash_demo+0x3943)
#2 0xab6b23a9ea77 in rte_jhash (/tmp/jhash_demo+0x3a77)
#3 0xab6b23a9ed37 in hash_ip_port (/tmp/jhash_demo+0x3d37)
#4 0xab6b23a9ef27 in main (/tmp/jhash_demo+0x3f27)
#5 0xffc1a9b57ce3 in __libc_start_main (/lib/libc.so.6+0x20ce3)
#6 0xab6b23a9bc53 (/tmp/jhash_demo+0xc53)
Address 0xffffe98f86c0 is located in stack of thread T0 at offset 32 in frame
#0 0xab6b23a9ec7b in hash_ip_port (/tmp/jhash_demo+0x3c7b)
This frame has 1 object(s):
[32, 34) 'port' <== Memory access at offset 32 partially overflows this
variable
HINT: this may be a false positive if your program uses some custom stack
unwind mechanism or swapcontext
(longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow (/tmp/jhash_demo+0x1b07) in
__rte_jhash_2hashes
Shadow bytes around the buggy address:
0x200ffd31f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x200ffd31f090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x200ffd31f0a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x200ffd31f0b0: 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 f2 f2
0x200ffd31f0c0: f2 f2 04 f2 f2 f2 f3 f3 f3 f3 00 00 00 00 00 00
=>0x200ffd31f0d0: 00 00 00 00 f1 f1 f1 f1[02]f2 f2 f2 f3 f3 f3 f3
0x200ffd31f0e0: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2
0x200ffd31f0f0: f2 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
0x200ffd31f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x200ffd31f110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x200ffd31f120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==23990==ABORTING
--
You are receiving this mail because:
You are the assignee for the bug.
reply other threads:[~2020-12-15 23:06 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-602-3@http.bugs.dpdk.org/ \
--to=bugzilla@dpdk.org \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.