From: bugzilla@dpdk.org
To: dev@dpdk.org
Subject: [dpdk-dev] [Bug 818] [asan] hash: buffer overflow in hash_autotest
Date: Sat, 02 Oct 2021 15:39:48 +0000 [thread overview]
Message-ID: <bug-818-3@http.bugs.dpdk.org/> (raw)
https://bugs.dpdk.org/show_bug.cgi?id=818
Bug ID: 818
Summary: [asan] hash: buffer overflow in hash_autotest
Product: DPDK
Version: unspecified
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: normal
Priority: Normal
Component: other
Assignee: dev@dpdk.org
Reporter: david.marchand@redhat.com
CC: bruce.richardson@intel.com,
vladimir.medvedkin@intel.com, yipeng1.wang@intel.com
Target Milestone: ---
This issue was caught by ASAN.
To reproduce, please look at the last patch of series 18997:
https://github.com/ovsrobot/dpdk/commit/series_18997
30/94 DPDK:fast-tests / hash_autotest FAIL 0.97 s (exit status 1)
--- command ---
DPDK_TEST='hash_autotest' /home/runner/work/dpdk/dpdk/build/app/test/dpdk-test
-l 0-1 --file-prefix=hash_autotest
--- stdout ---
RTE>>hash_autotest
--- stderr ---
EAL: Detected 2 lcore(s)
EAL: Detected 1 NUMA nodes
EAL: Detected shared linkage of DPDK
EAL: WARNING! Base virtual address hint (0x100005000 != 0x7f890e95a000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: Multi-process socket /var/run/dpdk/hash_autotest/mp_socket
EAL: Selected IOVA mode 'PA'
EAL: No available 1048576 kB hugepages reported
EAL: VFIO support initialized
EAL: WARNING! Base virtual address hint (0x10000b000 != 0x7f88fd558000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100011000 != 0x7f88fd39f000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100a12000 != 0x7f84fb800000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x100c17000 != 0x7f88fd33e000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x101618000 != 0x7f80fb600000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x10181d000 != 0x7f88fd19f000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x10221e000 != 0x7f7cfb400000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x102423000 != 0x7f88fd13e000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
EAL: WARNING! Base virtual address hint (0x102e24000 != 0x7f78fb200000) not
respected!
EAL: This may cause issues with mapping memory into secondary processes
APP: HPET is not enabled, using TSC as default timer
=================================================================
==25013==ERROR: AddressSanitizer: global-buffer-overflow on address
0x0000037220f0 at pc 0x0000014a8de4 bp 0x7ffe74374b30 sp 0x7ffe74374b28
READ of size 4 at 0x0000037220f0 thread T0
#0 0x14a8de3 in __rte_jhash_2hashes
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:104:9
#1 0x14abb53 in rte_jhash_32b_2hashes
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:259:2
#2 0x14aba71 in rte_jhash_32b
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:307:2
#3 0x7f890a546627 in rte_hash_hash
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_cuckoo_hash.c:538:9
#4 0x7f890a555672 in rte_hash_add_key
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_cuckoo_hash.c:1212:46
#5 0x1497373 in test_hash_add_delete_2_jhash2
/home/runner/work/dpdk/dpdk/build/../app/test/test_hash.c:1666:9
#6 0x14968e0 in test_hash
/home/runner/work/dpdk/dpdk/build/../app/test/test_hash.c:2187:6
#7 0x4d6166 in cmd_autotest_parsed
/home/runner/work/dpdk/dpdk/build/../app/test/commands.c:71:10
#8 0x7f890b0b46c5 in cmdline_parse
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_parse.c:290:3
#9 0x7f890b0ad8d5 in cmdline_valid_buffer
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:26:8
#10 0x7f890b0bef07 in rdline_char_in
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline_rdline.c:421:5
#11 0x7f890b0ae03f in cmdline_in
/home/runner/work/dpdk/dpdk/build/../lib/cmdline/cmdline.c:149:9
#12 0x5ac68e in main
/home/runner/work/dpdk/dpdk/build/../app/test/test.c:214:8
#13 0x7f890370bbf6 in __libc_start_main
/build/glibc-S9d2JN/glibc-2.27/csu/../csu/libc-start.c:310
#14 0x42ea19 in _start
(/home/runner/work/dpdk/dpdk/build/app/test/dpdk-test+0x42ea19)
0x0000037220f0 is located 48 bytes to the left of global variable
'hashtest_funcs' defined in '../app/test/test_hash.c:36:26' (0x3722120) of size
16
0x0000037220f0 is located 0 bytes to the right of global variable 'key' defined
in '../app/test/test_hash.c:1596:16' (0x37220e0) of size 16
SUMMARY: AddressSanitizer: global-buffer-overflow
/home/runner/work/dpdk/dpdk/build/../lib/hash/rte_jhash.h:104:9 in
__rte_jhash_2hashes
Shadow bytes around the buggy address:
0x0000806dc3c0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
0x0000806dc3d0: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
0x0000806dc3e0: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 01 f9 f9 f9
0x0000806dc3f0: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
0x0000806dc400: 00 00 00 00 00 00 00 00 01 f9 f9 f9 f9 f9 f9 f9
=>0x0000806dc410: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00[f9]f9
0x0000806dc420: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
0x0000806dc430: 00 00 00 00 04 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
0x0000806dc440: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
0x0000806dc450: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
0x0000806dc460: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==25013==ABORTING
-------
--
You are receiving this mail because:
You are the assignee for the bug.
reply other threads:[~2021-10-02 15:39 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-818-3@http.bugs.dpdk.org/ \
--to=bugzilla@dpdk.org \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.